Sun Java System Access Manager Debug Files Local Information Disclosure Vulnerability

Bugtraq ID:	35963
Class:	Design Error
CVE:	CVE-2009-2712
Remote:	No
Local:	Yes
Published:	Aug 05 2009 12:00AM
Updated:	Apr 13 2015 09:08PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Java System Access Manager 7.1 Windows Sun Java System Access Manager 7.1 Solaris x86 Sun Java System Access Manager 7.1 Solaris SPARC Sun Java System Access Manager 7.1 Linux Sun Java System Access Manager 7.0 2005Q4 Windows Sun Java System Access Manager 7.0 2005Q4 Solaris x Sun Java System Access Manager 7.0 2005Q4 Solaris S Sun Java System Access Manager 7.0 2005Q4 Linux Sun Java System Access Manager 7.0 2005Q4 HP-UX Sun Java System Access Manager 6.3 2005Q1 x86 Sun Java System Access Manager 6.3 2005Q1 SPARC Sun Java System Access Manager 6.3 2005Q1 Linux
Not Vulnerable:

Sun Java System Access Manager Debug Files Local Information Disclosure Vulnerability

Sun Java System Access Manager is prone to a local information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks.

This issue affects Sun Java System Access Manager 6 2005Q1, 7 2005Q4, 7.1, and OpenSSO Enterprise 8.0.

Sun Java System Access Manager Debug Files Local Information Disclosure Vulnerability

Attackers use system utilities to exploit this issue.

Sun Java System Access Manager Debug Files Local Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.


Sun Java System Access Manager 7.0 2005Q4 Windows

• Sun 124296-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -124296-10-1

Sun Java System Access Manager 7.1 Solaris SPARC

• Sun 126356-03
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126356-03-1

Sun Java System Access Manager 7.0 2005Q4 Solaris S

• Sun 120954-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120954-10-1

Sun Java System Access Manager 6.3 2005Q1 SPARC

• Sun 119465-16
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119465-16-1

Sun Java System Access Manager 7.0 2005Q4 HP-UX

• Sun 126371-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126371-10-1

Sun Java System Access Manager 7.1 Linux

• Sun 126358-03
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126358-03-1

Sun Java System Access Manager 7.0 2005Q4 Solaris x

• Sun 120955-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120955-10-1

Sun Java System Access Manager 7.0 2005Q4 Linux

• Sun 120956-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120956-10-1

Sun Java System Access Manager 7.1 Windows

• Sun 126359-03
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126359-03-1

Sun Java System Access Manager 7.1 Solaris x86

• Sun 126357-03
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -126357-03-1

Sun Java System Access Manager Debug Files Local Information Disclosure Vulnerability

References:

• Java System Access Manager Homepage (Sun)
  
• 256668 Sun Java System Access Manager (Sun)