Sun Communications Services Delegated Administrator Default Password Disclosure Vulnerability

Bugtraq ID:	15733
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 06 2005 12:00AM
Updated:	Dec 06 2005 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Sun Java System Messaging Server 6 2005Q1
Not Vulnerable:

Sun Communications Services Delegated Administrator Default Password Disclosure Vulnerability

Sun Java System Communications Services 6 Delegated Administrator 2005Q1 is prone to a vulnerability that can disclose the Top-Level Administrator (TLA) default password.

An attacker can exploit this issue to retrieve the password and gain TLA access.

Sun Communications Services Delegated Administrator Default Password Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Communications Services Delegated Administrator Default Password Disclosure Vulnerability

Solution:
The vendor has released patches addressing this issue:


Sun Java System Messaging Server 6 2005Q1

• Sun 119777-09
  SPARC Platform
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=119777-09&method=f


• Sun 119778-09
  x86 Platform
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=119778-09&method=f


• Sun 119779-09
  Linux Platform
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=119779-09&method=f

Sun Communications Services Delegated Administrator Default Password Disclosure Vulnerability

References:

• Sun Alert ID: 102068 - Security Vulnerability in Sun Java System Communications (Sun)