Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1077

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.

Published

2009-03-25T15:30:00.327

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sun	java_system_identity_manager	7.0	Yes
Application	sun	java_system_identity_manager	7.1	Yes
Application	sun	java_system_identity_manager	7.1.1	Yes
Application	sun	java_system_identity_manager	8.0	Yes

References

http://blogs.sun.com/security/entry/sun_alert_253267_sun_java Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/34380 Vendor Advisory ([email protected])
http://securitytracker.com/id?1021881 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 Patch ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 Patch ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 Patch ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1 Patch, Vendor Advisory ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/34191 Exploit, Patch ([email protected])
http://www.vupen.com/english/advisories/2009/0797 Vendor Advisory ([email protected])
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34380 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1021881 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/34191 Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/0797 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)