CVE-2007-3700
First published: Wed Jul 11 2007(Updated: )
Sun Java System Access Manager (formerly Java System Identity Server) before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading /var/opt/SUNWam/debug/amAuth.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Access Manager |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101918-1
- http://www.securityfocus.com/bid/24859
- http://www.securitytracker.com/id?1018370
- http://secunia.com/advisories/26030
- http://osvdb.org/37249
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200386-1
- http://www.vupen.com/english/advisories/2007/2496
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35339
Frequently Asked Questions
What is the severity of CVE-2007-3700?
CVE-2007-3700 is classified as a vulnerability that allows local users to access sensitive information.
How do I fix CVE-2007-3700?
To fix CVE-2007-3700, upgrade to Sun Java System Access Manager version 20070710 or later.
What specific information does CVE-2007-3700 expose?
CVE-2007-3700 exposes cleartext login passwords in the logs when the debug level is configured improperly.
Who can exploit the CVE-2007-3700 vulnerability?
Local users with access to the logging files can exploit the CVE-2007-3700 vulnerability.
What systems are affected by CVE-2007-3700?
CVE-2007-3700 affects Sun Java System Access Manager versions prior to 20070710.
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/description
- vendor/sun
- canonical/oracle access manager