CVE-2009-1077
First published: Wed Mar 25 2009(Updated: )
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java System Identity Manager | =7.1.1 | |
| Sun Java System Identity Manager | =7.0 | |
| Sun Java System Identity Manager | =7.1 | |
| Sun Java System Identity Manager | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1021881
- http://www.vupen.com/english/advisories/2009/0797
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
- http://www.securityfocus.com/bid/34191
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
- http://secunia.com/advisories/34380
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sun
- canonical/sun java system identity manager
- version/sun java system identity manager/7.1.1
- version/sun java system identity manager/7.0
- version/sun java system identity manager/7.1
- version/sun java system identity manager/8.0