Bug Id
17763, 18052, 18104, 18578, 18946, 19033, 19115, 19595, 19659, 19660, 19661, 19683, 20174, 20224, 20352


Date of Resolved Release
19-Mar-2009

Sun Java System Identity Manager Security Vulnerabilities (see below for full details)

1. Impact

Sun Java System Identity Manager (IdM) is affected by multiple security
vulnerabilities with varying impacts as follows:

A remote unprivileged user may be able to gain unauthorized access to data being
transferred between clients and the IdM server due to some connections not being
secured with SSL (17763).

A local or remote unprivileged user may be able to determine the existence of
valid IdM account names (18052, 18104).

A user with an account on the IdM server may be able to change the password
of other IdM accounts (18578).

A user with an account on the IdM server may be able to perform some
actions with additional capabilities than those assigned (18946, 20352).

A remote unprivileged user may be able to execute unauthorized HTML code or
client-side scripts in a user's browser due to multiple Cross-Site Scripting
(XSS) vulnerabilities (19033, 19595, 19659, 19660, 19661, 19683).

A user with an account on the IdM server may be able to submit arbitrary
commands to the Admin Console and then be able to perform administrative
actions such as creating accounts (19115).

A local or remote unprivileged user may be able to execute arbitrary
commands on Unix/Linux based resource adapters (20174).

A local or remote unprivileged user may be able to modify IdM system
configuration data (20224).

Sun acknowledges with thanks Dan Sinclair of Security Compass for bringing
issue 19033 to our attention.

Sun acknowledges with thanks ProCheckUp Ltd for bringing issues 19595 and
19661 to our attention.

Sun acknowledges with thanks Alexandre Bezroutchko of Scanit for bringing
issue 20174 to our attention.

Sun acknowledges with thanks, Marco Mella (http://www.aboutsecurity.net/) for
bringing issue 18052 to our attention.

2. Contributing Factors

These issues can occur in the following releases:

• Sun Java System Identity Manager 7.0 without patch 140935-01
• Sun Java System Identity Manager 7.1 without patch 140936-01
• Sun Java System Identity Manager 7.1.1 without patch 137621-11
• Sun Java System Identity Manager 8.0 without patch 139010-06
  

Notes:
Identity Manager 8.1 is not affected by these issues.

To determine the version of Sun Java System Identity Manager installed on a system, log in to the administrator console using a browser and hover the mouse pointer over the "Help" tab in the upper right portion of the masthead. The current version will be displayed similar to the following:

       Version Sun Java System Identity Manager 7.0 (20070523)

3. Symptoms

There are no predictable symptoms that would indicate the described issues have been exploited.

4. Workaround

There are no workarounds for these issues.  Please see the Resolution section below.

5. Resolution

These issues are addressed in the following releases:

• Sun Java System Identity Manager 7.0 with patch 140935-01
• Sun Java System Identity Manager 7.1 with patch 140936-01
• Sun Java System Identity Manager 7.1.1 with patch 137621-11
• Sun Java System Identity Manager 8.0 with patch 139010-06

Note: for all Identity Manager supported platforms refer to your installation guide. See patch README for other patch dependencies.


For more information on Security Sun Alerts, see

Modification History
20-Mar-2009 Modification to Impact section

Product
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1
Sun Java System Identity Manager 8.0

References

140935-01
140936-01
137621-11
139010-06

References

SUNPATCH:137621-11
SUNPATCH:139010-06
SUNPATCH:140935-01
SUNPATCH:140936-01



Attachments

This solution has no attachment