Note: This is an archival copy of Security Sun Alert 200558 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000425.1.
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 6.0
Sun Java System Identity Manager 7.1
Date of Preliminary Release
Date of Resolved Release
Multiple Security Vulnerabilities in the Sun Java System Identity Manager May Allow HTML Injection, Cross-Site Scripting Exploits or Unauthorized Redirection (see details below)
Sun Java System Identity Manager is affected by multiple security vulnerabilties with varying impacts.
Four Cross-site Scripting (XSS) vulnerabilities may allow local or remote unprivileged users the ability to execute unauthorized scripting code in a user's browser when that user clicks a link to Sun Java System Identity Manager. In addition, a further vulnerability may allow a local or remote unprivileged user to inject unauthorized HTML code into a user's browser when that user clicks a link to Sun Java System Identity Manager. Two additional vulnerabilities may allow a local or remote unprivileged user to redirect the browser to unintended remote sites or to inject frames containing data from unintended sites.
Sun would like to acknowledge with thanks, Adrian Pastor and Jan Fry of ProCheckUp Ltd. for bringing 6 of these issues to our attention.2. Contributing Factors
These issues can occur in the following releases (for all supported platforms):
To determine the version of Sun Java System Identity Manager installed on a system, log in to the administrator console using a browser and hover the mouse pointer over the "Help" tab in the upper right portion of the masthead. The current version will be displayed similar to the following:
Version Sun Java System Identity Manager 7.0 (20070523)3. Symptoms
There are no predictable symptoms that would indicate the described issues have been exploited.4. Workaround
There is no workaround for these issues. Please see the Resolution section below.
These issues are addressed in the following releases (for all supported platforms):
For more information on Security Sun Alerts, see Sun 1009886.1.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
14-Jan-2008: Updated Contributing Factors and Resolution sections, State: Resolved
16-Jan-2008: Updated Contributing Factors and Resolution sections
09-Sep-2008: No content updated, change status to Resolved from Preliminary, issue was Resolved 14-Jan-2008
This solution has no attachment