CVE-2009-1075
First published: Wed Mar 25 2009(Updated: )
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java System Identity Manager | =7.1.1 | |
| Sun Java System Identity Manager | =7.0 | |
| Sun Java System Identity Manager | =7.1 | |
| Sun Java System Identity Manager | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1021881
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
- http://secunia.com/advisories/34380
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
- http://www.vupen.com/english/advisories/2009/0797
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
- http://www.securityfocus.com/bid/34191
Frequently Asked Questions
What is the severity of CVE-2009-1075?
CVE-2009-1075 has a medium severity rating due to its potential for user enumeration vulnerabilities.
How does CVE-2009-1075 affect user accounts?
CVE-2009-1075 allows attackers to distinguish between valid and invalid usernames based on the response from the Forgot Password feature.
Which versions of Sun Java System Identity Manager are affected by CVE-2009-1075?
CVE-2009-1075 affects Sun Java System Identity Manager versions 7.0 through 8.0.
How can I fix CVE-2009-1075?
To fix CVE-2009-1075, upgrade to a patched version of Sun Java System Identity Manager that mitigates the enumeration flaw.
What is the impact of exploiting CVE-2009-1075?
Exploitation of CVE-2009-1075 can lead to an increased risk of attacks such as password guessing and account enumeration.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- vendor/sun
- canonical/sun java system identity manager
- version/sun java system identity manager/7.1.1
- version/sun java system identity manager/7.0
- version/sun java system identity manager/7.1
- version/sun java system identity manager/8.0