CVE-2009-1077: Medium severity Sun Java System Identity Manager vulnerability
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1077?
CVE-2009-1077 is classified as a high severity vulnerability due to the potential for unauthorized password changes by authenticated users.
How do I fix CVE-2009-1077?
To mitigate CVE-2009-1077, ensure that the RequiresChallenge property is enforced in the Change My Password implementation.
What software versions are affected by CVE-2009-1077?
CVE-2009-1077 affects Sun Java System Identity Manager versions 7.0, 7.1, 7.1.1, and 8.0.
Can CVE-2009-1077 allow remote attacks?
Yes, CVE-2009-1077 allows remote authenticated users to change other users' passwords, which can lead to account compromise.
What operational environment does CVE-2009-1077 impact?
CVE-2009-1077 impacts the admin interface of the Sun Java System Identity Manager, affecting user account management functionalities.