—–BEGIN PGP SIGNED MESSAGE—–

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes Sun Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

Sun Bug ID 6740852 / CVE-2009-0170 – Sun Java System Access Manager gibt
Passworte preis

Im Sun Java System Access Manager Version 6.3 – 7.1 koennen Benutzer
mit Zugang zur Admin Console Passworte anderer Benutzer einsehen sowie
Zugang zu weiteren, nicht genannten, Resourcen erlangen. Ursache ist
eine nicht naeher beschriebene Schwachstelle in der Komponente
“Configuration Items” der Console.

Betroffen sind die folgenden Software Pakete und Plattformen:

Sun Java System Access Manager 7 2005Q4
Sun Java System Identity Manager 7.1
Sun Java System Access Manager 6.3 2005Q1

SPARC Plattform
* Sun Java System Access Manager 7.1 (fuer Solaris 8, 9 und 10)
ohne Patch 126356-02
* Sun Java System Access Manager 7 2005Q4 (fuer Solaris 8, 9 und 10)
ohne Patch 120954-08
* Sun Java System Access Manager 6.3 2005Q1 (fuer Solaris 8, 9 und 10)
ohne Patch 119465-15

x86 Plattform
* Sun Java System Access Manager 7.1 (fuer Solaris 8, 9 und 10)
ohne Patch 126357-02
* Sun Java System Access Manager 7 2005Q4 (fuer Solaris 9 und 10)
ohne Patch 120955-08
* Sun Java System Access Manager 6.3 2005Q1 (fuer Solaris 8, 9 und 10)
ohne Patch 119465-15

Linux Plattform
* Sun Java System Access Manager 7.1 ohne Patch 126358-02
* Sun Java System Access Manager 7 2005Q4 ohne Patch 120956-08
* Sun Java System Access Manager 6.3 2005Q1 ohne Patch 119502-15

Windows Plattform
* Sun Java System Access Manager 7.1 ohne Patch 126359-02
* Sun Java System Access Manager 7 2005Q4 ohne Patch 124296-08

HP-UX
* Sun Java System Access Manager 7 2005Q4 ohne Patch 126371-08

Andere
* Sun Java System Access Manager 7.1 Installation per WAR Datei (all
Plattforms) ohne Patch 140504-02

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242166-1

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Klaus Moeller, DFN-CERT

– —
Dipl. Inform. Klaus Moeller (Incident Response Team)
Phone: +49 40 808077-555, Fax: +49 40 808077-556

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrase 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

16. DFN-Workshop Sicherheit in vernetzten Systemen
https://www.dfn-cert.de/ws2009/

Solution Type Sun Alert
Solution 242166 : Security Vulnerability in Sun Java System Access
Manager May Allow Unauthorized Access Through Revealed Passwords
Related Categories

* Home>Content>Sun Alert Criteria Categories>Security
* Home>Content>Sun Alert Release Phase>Resolved

Bug ID
6740852

Product
Sun Java System Access Manager 7 2005Q4
Sun Java System Identity Manager 7.1
Sun Java System Access Manager 6.3 2005Q1

Date of Resolved Release
12-Jan-2009

SA Document Body
A security vulnerability in the Sun Java System Access Manager may allow unauth
orized access to resources:

1. Impact
A security vulnerability in the Sun Java System Access Manager may
allow unauthorized access to resources by revealing passwords to remote
users who have privileges to access the administration console.
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
* Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10)
without patch 126356-02
* Sun Java System Access Manager 7 2005Q4 (for Solaris 8, 9 and 10)
without patch 120954-08
* Sun Java System Access Manager 6.3 2005Q1 (for Solaris 8, 9 and 10)
without patch 119465-15

x86 Platform
* Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10)
without patch 126357-02
* Sun Java System Access Manager 7 2005Q4 (for Solaris 9 and 10)
without patch 120955-08
* Sun Java System Access Manager 6.3 2005Q1 (for Solaris 8, 9 and 10)
without patch 119465-15

Linux Platform
* Sun Java System Access Manager 7.1 without patch 126358-02
* Sun Java System Access Manager 7 2005Q4 without patch 120956-08
* Sun Java System Access Manager 6.3 2005Q1 without patch 119502-15

Windows Platform
* Sun Java System Access Manager 7.1 without patch 126359-02
* Sun Java System Access Manager 7 2005Q4 without patch 124296-08

HP-UX
* Sun Java System Access Manager 7 2005Q4 without patch 126371-08

Other
* Sun Java System Access Manager 7.1 WAR file-based installation (all
platforms) without patch 140504-02

Note: Sun Java System Access Manager 6.2 and 6.1 are not affected by
this issue.
To determine the version of Access Manager on a Solaris system, the
following command can be run:
$ pkgparam SUNWamsvc VERSION
7.1,REV=06.12.19.15.12

To determine the version of Sun Java System Access Manager on other
systems, the following command can be run (as the “root” user):
# /bin/amadmin –version
Sun Java System Access Manager 7.1

3. Symptoms
There are no predictable symptoms that would indicate the described
issue has been exploited.
4. Workaround
There is no workaround for this issue. Please see the Resolution
section below.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
* Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10) with
patch 126356-02 or later
* Sun Java System Access Manager 7 2005Q4 (for Solaris 8, 9 and 10)
with patch 120954-08 or later
* Sun Java System Access Manager 6.3 2005Q1 (for Solaris 8, 9 and 10)
with patch 119465-15 or later

x86 Platform
* Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10) with
patch 126357-02 or later
* Sun Java System Access Manager 7 2005Q4 (for Solaris 9 and 10) with
patch 120955-08 or later
* Sun Java System Access Manager 6.3 2005Q1 (for Solaris 8, 9 and 10)
with patch 119465-15 or later

Linux Platform
* Sun Java System Access Manager 7.1 with patch 126358-02 or later
* Sun Java System Access Manager 7 2005Q4 with patch 120956-08 or
later
* Sun Java System Access Manager 6.3 2005Q1 with patch 119502-15 or
later

Windows Platform
* Sun Java System Access Manager 7.1 with patch 126359-02 or later
* Sun Java System Access Manager 7 2005Q4 with patch 124296-08 or
later

HP-UX
* Sun Java System Access Manager 7 2005Q4 with patch 126371-08 or
later

Other
* Sun Java System Access Manager 7.1 WAR file-based installation (all
platforms) with patch 140504-02 or later

For more information on Security Sun Alerts, see Technical Instruction
ID 213557.
This Sun Alert notification is being provided to you on an “AS IS”
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
Attachments
This solution has no attachment

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)

iQEVAwUBSXiJdEhXCWfrVVdXAQGvbwf/RdIuJ+apCsyl8jfejKiiF+1MAVj5dU6l
xy9k15g+xRlaFHQj+xZuEzCw/41PA9Zufpp9O6PfVagb4FDS30Dqy+I5tjPEizAI
/xbms/vcMF8KGeGUM2HjqeZSyWQ1qRyluq5VVbJYJgwxQ32txszpl1Bs7fW/jdEv
NZp+NMRiq8bOEy2G7RRcBM3IGc8ZK47VdsUhZ0GyR9nBCXAonu1R0yTLtewgNRfT
unIe/JM1B6CZg0WgFE/heyTTGqI5M7mL6pVhufCOAKJgtGD4EqDKiHPskqUhQdh2
GLSn+1vI0DFrYkLo204xVVLXGCiNbUdVbgeAYQi4h2jH7PWt094kJQ==
=nV4A
—–END PGP SIGNATURE—–