Novell Access Manager Identity Server X.509 Authentication Security Bypass Vulnerability

Bugtraq ID:	40427
Class:	Access Validation Error
CVE:	CVE-2009-4879
Remote:	Yes
Local:	No
Published:	Jul 17 2009 12:00AM
Updated:	Jul 17 2009 12:00AM
Credit:	Novell
Vulnerable:	Novell Access Manager 3.1 Novell Access Manager 3
Not Vulnerable:	Novell Access Manager 3.1 SP1

Novell Access Manager Identity Server X.509 Authentication Security Bypass Vulnerability

Novell Access Manager is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass security restrictions and gain access to the system; this may aid in further attacks.

The vulnerability affects versions prior to Novell Access Manager 3.1 SP1.

Novell Access Manager Identity Server X.509 Authentication Security Bypass Vulnerability

Attackers can exploit this issue using readily available tools.

Novell Access Manager Identity Server X.509 Authentication Security Bypass Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Novell Access Manager Identity Server X.509 Authentication Security Bypass Vulnerability

References:

• Novell Access Manager 3.1 SP1 Readme (Novell)
  
• Novell Access Manager Homepage (Novell)