CVE-2009-1077
First published: Wed Mar 25 2009(Updated: )
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java System Identity Manager | =7.1.1 | |
| Sun Java System Identity Manager | =7.0 | |
| Sun Java System Identity Manager | =7.1 | |
| Sun Java System Identity Manager | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1021881
- http://www.vupen.com/english/advisories/2009/0797
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
- http://www.securityfocus.com/bid/34191
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
- http://secunia.com/advisories/34380
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
Frequently Asked Questions
What is the severity of CVE-2009-1077?
CVE-2009-1077 is classified as a high severity vulnerability due to the potential for unauthorized password changes by authenticated users.
How do I fix CVE-2009-1077?
To mitigate CVE-2009-1077, ensure that the RequiresChallenge property is enforced in the Change My Password implementation.
What software versions are affected by CVE-2009-1077?
CVE-2009-1077 affects Sun Java System Identity Manager versions 7.0, 7.1, 7.1.1, and 8.0.
Can CVE-2009-1077 allow remote attacks?
Yes, CVE-2009-1077 allows remote authenticated users to change other users' passwords, which can lead to account compromise.
What operational environment does CVE-2009-1077 impact?
CVE-2009-1077 impacts the admin interface of the Sun Java System Identity Manager, affecting user account management functionalities.
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/sun
- canonical/sun java system identity manager
- version/sun java system identity manager/7.1.1
- version/sun java system identity manager/7.0
- version/sun java system identity manager/7.1
- version/sun java system identity manager/8.0