Sun Java System Access Manager 7.1 allows remote authenticated sub-realm administrators to gain privileges, as demonstrated by creating the amadmin account in the sub-realm, and then logging in as amadmin in the root realm.

Sun Java System Access Manager 7.1 Solaris_x86.
Date this patch was last updated by Sun : Apr/23/11

Sun Java System Access Manager 7.1 Solaris.
Date this patch was last updated by Sun : Apr/23/11

The remote host is running a version of Sun Java System Access Manager 7.1 earlier than Patch 2. Such versions are potentially affected by multiple issues : 

  - A vulnerability may allow unauthorized access to resources by revealing passwords to remote users who have privileges to access the administration console. (1-66-242166-1)

  - A sub-realm administrator may be able to escalate their privileges and access the root realm as an administrator. (1-66-249106-1)

  - A username-enumeration weakness could allow an attacker to determine valid user-names. (1-66-242026-1)

ID	Name	Product	Family	Severity
107950	Solaris 10 (x86) : 126357-06	Nessus	Solaris Local Security Checks	critical
107450	Solaris 10 (sparc) : 126356-06	Nessus	Solaris Local Security Checks	critical
5132	Sun Java System Access Manager 7.1 < Patch 2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2009-0169

high

Tenable Plugins

critical

critical

medium