PT-2009-5096 · Sun · Opensso Enterprise+1

Published 2009-08-07 · Updated 2009-08-15 · CVE-2009-2712

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions 6.3 2005Q1 through 7.1 OpenSSO Enterprise version 8.0

Description The issue allows local users to discover cleartext passwords by reading debug files when the debug flag is enabled in AMConfig.properties.

Recommendations For Sun Java System Access Manager versions 6.3 2005Q1 through 7.1, consider disabling the debug flag in AMConfig.properties to prevent cleartext passwords from being written to debug files. For OpenSSO Enterprise version 8.0, consider disabling the debug flag in AMConfig.properties to prevent cleartext passwords from being written to debug files.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2712

Affected Products

Opensso Enterprise

Sun Java System Access Manager

References · 8

• http://secunia.com/advisories/36169 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-256668-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2712 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-16-1 · Patch
• http://securityfocus.com/bid/35963 · Note
• http://osvdb.org/56815 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2712 · Note
• http://vupen.com/english/advisories/2009/2177 · Note