Sun Java System Access Manager Logging Output Password Disclosure Vulnerability

Bugtraq ID:	24859
Class:	Design Error
CVE:	CVE-2007-3700
Remote:	No
Local:	Yes
Published:	Jul 10 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The vendor reported this issue.
Vulnerable:	Sun Java System Access Manager 6.2 2004Q2 Solaris x Sun Java System Access Manager 6.2 2004Q2 Solaris S Sun Java System Access Manager 6.2 2004Q2 Linux Sun Java System Access Manager 6.1 Sun Java System Access Manager 6 2005Q1 Solaris x86 Sun Java System Access Manager 6 2005Q1 Solaris SPA Sun Java System Access Manager 6 2005Q1 Linux
Not Vulnerable:

Sun Java System Access Manager Logging Output Password Disclosure Vulnerability

Sun Java System Access Manager may allow local attackers to access user passwords.

By exploiting this issue, attackers may subsequently gain unauthorized access to user identities that are managed by Java System Access Manager.

Sun Java System Access Manager Logging Output Password Disclosure Vulnerability

An attacker can manually carry out this attack after obtaining local access.

Sun Java System Access Manager Logging Output Password Disclosure Vulnerability

Solution:
The vendor has released patches to address this issue. Please see references for more information.

Sun Java System Access Manager Logging Output Password Disclosure Vulnerability

References:

• Sun Alert ID: 101918 - Security Vulnerability in the Logging Output of Sun Java (Sun)