CVE-2009-1074
First published: Wed Mar 25 2009(Updated: )
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java System Identity Manager | =7.1.1 | |
| Sun Java System Identity Manager | =7.0 | |
| Sun Java System Identity Manager | =7.1 | |
| Sun Java System Identity Manager | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/34380
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
- http://www.vupen.com/english/advisories/2009/0797
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
- http://securitytracker.com/id?1021881
- http://www.securityfocus.com/bid/34191
Frequently Asked Questions
What is the severity of CVE-2009-1074?
CVE-2009-1074 is classified as a medium severity vulnerability due to its potential for sensitive information exposure.
How do I fix CVE-2009-1074?
To mitigate CVE-2009-1074, it is recommended to enable SSL for all network communications involving the affected Sun Java System Identity Manager versions.
What versions are affected by CVE-2009-1074?
CVE-2009-1074 affects Sun Java System Identity Manager versions 7.0 through 8.0.
What types of sensitive information are at risk with CVE-2009-1074?
CVE-2009-1074 exposes sensitive information such as user credentials and personal data since SSL is not used in all circumstances.
Can CVE-2009-1074 lead to remote attacks?
Yes, CVE-2009-1074 can facilitate remote attacks by allowing attackers to sniff the network and capture unprotected data.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/sun
- canonical/sun java system identity manager
- version/sun java system identity manager/7.1.1
- version/sun java system identity manager/7.0
- version/sun java system identity manager/7.1
- version/sun java system identity manager/8.0