Sun Java System Identity Manager Multiple Vulnerabilities
BID:34191
Info
Sun Java System Identity Manager Multiple Vulnerabilities
| Bugtraq ID: | 34191 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 20 2009 12:00AM |
| Updated: | May 12 2009 10:06PM |
| Credit: | Marco Mella, Dan Sinclair of Security Compass, ProCheckUp Ltd, Alexandre Bezroutchko of Scanit, and the vendor. |
| Vulnerable: |
Sun Java System Identity Manager 7.1.1 Sun Java System Identity Manager 8.0 Sun Java System Identity Manager 7.1 Sun Java System Identity Manager 7.0 |
| Not Vulnerable: |
Sun Java System Identity Manager 8.1 |
Discussion
Sun Java System Identity Manager Multiple Vulnerabilities
Sun Java System Identity Manager is prone to multiple vulnerabilities, including information-disclosure issues, cross-site scripting issues, privilege-escalation issues, and a remote code-execution vulnerability.
Successful exploits may allow an attacker to obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user in the context of a site, perform unauthorized actions, or gain unauthorized access to the affected application. This may aid in the complete compromise of the computer. Other attacks are also possible.
These issues affect the following versions:
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 7.1.1
Sun Java System Identity Manager 8.0
Sun Java System Identity Manager is prone to multiple vulnerabilities, including information-disclosure issues, cross-site scripting issues, privilege-escalation issues, and a remote code-execution vulnerability.
Successful exploits may allow an attacker to obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user in the context of a site, perform unauthorized actions, or gain unauthorized access to the affected application. This may aid in the complete compromise of the computer. Other attacks are also possible.
These issues affect the following versions:
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 7.1.1
Sun Java System Identity Manager 8.0
Exploit / POC
Sun Java System Identity Manager Multiple Vulnerabilities
For some issues, an attacker may use a browser or entice an unsuspecting user into following a malicious URI.
The following example request is available for the command-injection issue:
POST /idm/user/changePassword.jsp?lang=en&cntry=US HTTP/1.1
id=***&command=Save&activeControl=&resourceAccounts.selectAll=true&
resourceAccounts.password=id>/x%0aid>/x&resourceAccounts.confirmPassword=id>/x%0aid>/x
The following example is available to trigger the username-enumeration issue:
For some issues, an attacker may use a browser or entice an unsuspecting user into following a malicious URI.
The following example request is available for the command-injection issue:
POST /idm/user/changePassword.jsp?lang=en&cntry=US HTTP/1.1
id=***&command=Save&activeControl=&resourceAccounts.selectAll=true&
resourceAccounts.password=id>/x%0aid>/x&resourceAccounts.confirmPassword=id>/x%0aid>/x
The following example is available to trigger the username-enumeration issue:
Solution / Fix
Sun Java System Identity Manager Multiple Vulnerabilities
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 8.0
Sun Java System Identity Manager 7.1.1
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 8.0
Sun Java System Identity Manager 7.1.1
References
Sun Java System Identity Manager Multiple Vulnerabilities
References:
References:
- Sun Java System Identiy Manager Users enumeration (AboutSecurity)
- Sun Alert 253267 Sun Java System Identity Manager Security Vulnerabilities (Sun)
- Sun Identity Manager (Sun)
- Sun IDM Arbitrary Commands Execution Vulnerability (Alexandre Bezroutchko)
- Sun IDM Arbitrary Commands Execution Vulnerability ("[email protected]"
- Solution 253267 : Sun Java System Identity Manager Security Vulnerabilities (Sun)