Note: This is an archival copy of Security Sun Alert 253267 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020159.1.
17763, 18052, 18104, 18578, 18946, 19033, 19115, 19595, 19659, 19660, 19661, 19683, 20174, 20224, 20352
Date of Resolved Release
Sun Java System Identity Manager Security Vulnerabilities (see below for full details)
1. ImpactSun Java System Identity Manager (IdM) is affected by multiple security
vulnerabilities with varying impacts as follows:
A remote unprivileged user may be able to gain unauthorized access to data being
transferred between clients and the IdM server due to some connections not being
secured with SSL (17763).
A local or remote unprivileged user may be able to determine the existence of
valid IdM account names (18052, 18104).
A user with an account on the IdM server may be able to change the password
of other IdM accounts (18578).
A user with an account on the IdM server may be able to perform some
actions with additional capabilities than those assigned (18946, 20352).
A remote unprivileged user may be able to execute unauthorized HTML code or
client-side scripts in a user's browser due to multiple Cross-Site Scripting
(XSS) vulnerabilities (19033, 19595, 19659, 19660, 19661, 19683).
A user with an account on the IdM server may be able to submit arbitrary
commands to the Admin Console and then be able to perform administrative
actions such as creating accounts (19115).
A local or remote unprivileged user may be able to execute arbitrary
commands on Unix/Linux based resource adapters (20174).
A local or remote unprivileged user may be able to modify IdM system
configuration data (20224).
Sun acknowledges with thanks Dan Sinclair of Security Compass for bringing
issue 19033 to our attention.
Sun acknowledges with thanks ProCheckUp Ltd for bringing issues 19595 and
19661 to our attention.
Sun acknowledges with thanks Alexandre Bezroutchko of Scanit for bringing
issue 20174 to our attention.
Sun acknowledges with thanks, Marco Mella (http://www.aboutsecurity.net/) for
bringing issue 18052 to our attention.
2. Contributing FactorsThese issues can occur in the following releases:
Identity Manager 8.1 is not affected by these issues.
To determine the version of Sun Java System Identity Manager installed on a system, log in to the administrator console using a browser and hover the mouse pointer over the "Help" tab in the upper right portion of the masthead. The current version will be displayed similar to the following:
Version Sun Java System Identity Manager 7.0 (20070523)
3. SymptomsThere are no predictable symptoms that would indicate the described issues have been exploited.
4. WorkaroundThere are no workarounds for these issues. Please see the Resolution section below.
5. ResolutionThese issues are addressed in the following releases:
For more information on Security Sun Alerts, see
20-Mar-2009 Modification to Impact section
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 8.0
This solution has no attachment