CVE-2009-1084

Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://securitytracker.com/id?1021881
http://www.securityfocus.com/bid/34191
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1	Patch Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1	Patch
http://www.vupen.com/english/advisories/2009/0797	Vendor Advisory
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java	Patch
http://secunia.com/advisories/34380	Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/49607

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sun:java_system_identity_manager:7.0:::::::*
	cpe:2.3:a:sun:java_system_identity_manager:7.1:::::::*
	cpe:2.3:a:sun:java_system_identity_manager:7.1.1:::::::*
	cpe:2.3:a:sun:java_system_identity_manager:8.0:::::::*

Information

Published : 2009-03-25 08:30

Updated : 2017-08-16 18:30

NVD link : CVE-2009-1084

Mitre link : CVE-2009-1084

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

sun

java_system_identity_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://securitytracker.com/id?1021881", "name": "1021881", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/34191", "name": "34191", "tags": [], "refsource": "BID"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1", "name": "253267", "tags": ["Patch", "Vendor Advisory"], "refsource": "SUNALERT"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1", "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.vupen.com/english/advisories/2009/0797", "name": "ADV-2009-0797", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://blogs.sun.com/security/entry/sun_alert_253267_sun_java", "name": "http://blogs.sun.com/security/entry/sun_alert_253267_sun_java", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/34380", "name": "34380", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1", "name": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49607", "name": "jsim-sco-unspecified(49607)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-1084", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-03-25T15:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sun:java_system_identity_manager:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_system_identity_manager:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_system_identity_manager:7.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_system_identity_manager:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:30Z"}