PT-2009-5097 · Sun · Sun Java System Access Manager

Published 2009-08-07 · Updated 2009-08-15 · CVE-2009-2713

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions 7.0 2005Q4 through 7.1

Description The issue concerns the CDCServlet component when Cross Domain Single Sign On (CDSSO) is enabled. It fails to ensure that policy advice is presented to the correct client, allowing remote attackers to obtain sensitive information.

Recommendations For Sun Java System Access Manager versions 7.0 2005Q4 through 7.1, consider disabling the CDCServlet component or CDSSO functionality until a fix is available to prevent sensitive information disclosure.

Fix

Related Identifiers

CVE-2009-2713

Affected Products

Sun Java System Access Manager

References · 7

• http://securityfocus.com/bid/35961 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2713 · Security Note
• http://secunia.com/advisories/36167 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2176 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2713 · Note