Sun Java System Access Manager 'sub-realm' Privilege Escalation Vulnerability

Bugtraq ID:	33266
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2009 12:00AM
Updated:	Jan 14 2009 06:52PM
Credit:	The vendor
Vulnerable:	Sun Java System Access Manager 7.1 Windows Sun Java System Access Manager 7.1 Solaris x86 Sun Java System Access Manager 7.1 Solaris SPARC Sun Java System Access Manager 7.1 Linux
Not Vulnerable:

Sun Java System Access Manager 'sub-realm' Privilege Escalation Vulnerability

Sun Java System Access Manager is prone to a privilege-escalation vulnerability.

Attackers can exploit this issue to elevate their privileges. Successfully exploiting this issue may result in the complete compromise of affected applications.

Sun Java System Access Manager 'sub-realm' Privilege Escalation Vulnerability

Attackers need privileged access to the affected application to exploit this issue.

Sun Java System Access Manager 'sub-realm' Privilege Escalation Vulnerability

Solution:
Sun has released patches and an advisory. Please see the references for more information.


Sun Java System Access Manager 7.1 Linux

• Sun 126358-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126358-02-1

Sun Java System Access Manager 7.1 Solaris SPARC

• Sun 126356-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126356-02-1

Sun Java System Access Manager 7.1 Solaris x86

• Sun 126357-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126357-02-1

Sun Java System Access Manager 7.1 Windows

• Sun 126359-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126359-02-1

Sun Java System Access Manager 'sub-realm' Privilege Escalation Vulnerability

References:

• Java System Access Manager Homepage (Sun)
  
• Solution 249106 : A Security Vulnerability in Sun Java System Access Manager (Sun)