Sun Java System Access Manager Information Disclosure Vulnerability

Bugtraq ID:	33265
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2009 12:00AM
Updated:	Jan 14 2009 07:12PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Java System Access Manager 7.1 Windows Sun Java System Access Manager 7.1 Solaris x86 Sun Java System Access Manager 7.1 Solaris SPARC Sun Java System Access Manager 7.1 Linux Sun Java System Access Manager 7.1 HP-UX Sun Java System Access Manager 7.0 2005Q4 Windows Sun Java System Access Manager 7.0 2005Q4 Solaris x Sun Java System Access Manager 7.0 2005Q4 Solaris S Sun Java System Access Manager 7.0 2005Q4 Linux Sun Java System Access Manager 7.0 2005Q4 HP-UX Sun Java System Access Manager 6.3 2005Q1 x86 Sun Java System Access Manager 6.3 2005Q1 SPARC Sun Java System Access Manager 6.3 2005Q1 Linux
Not Vulnerable:

Sun Java System Access Manager Information Disclosure Vulnerability

Sun Java System Access Manager is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks.

Sun Java System Access Manager Information Disclosure Vulnerability

Attackers use the application itself to exploit this issue.

Sun Java System Access Manager Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.


Sun Java System Access Manager 7.0 2005Q4 Windows

• Sun 124296-08
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -124296-08-1

Sun Java System Access Manager 7.1 Solaris SPARC

• Sun 126356-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126356-02-1

Sun Java System Access Manager 7.0 2005Q4 Solaris S

• Sun 120954-08
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120954-08-1

Sun Java System Access Manager 6.3 2005Q1 SPARC

• Sun 119465-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119465-15-1

Sun Java System Access Manager 7.0 2005Q4 HP-UX

• Sun 126371-08
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126371-08-1

Sun Java System Access Manager 6.3 2005Q1 Linux

• Sun 119502-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119502-15-1

Sun Java System Access Manager 7.1 Linux

• Sun 126358-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126358-02-1

Sun Java System Access Manager 7.0 2005Q4 Solaris x

• Sun 120955-08
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120955-08-1

Sun Java System Access Manager 7.0 2005Q4 Linux

• Sun 120956-08
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120956-08-1

Sun Java System Access Manager 7.1 Windows

• Sun 126359-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126359-02-1

Sun Java System Access Manager 7.1 Solaris x86

• Sun 126357-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126357-02-1

Sun Java System Access Manager Information Disclosure Vulnerability

References:

• Java System Access Manager Homepage (Sun)
  
• Solution 242166 : Security Vulnerability in Sun Java System Access Manager Ma (Sun)