The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.

Sun Java System Access Manager 7.1 Solaris_x86.
Date this patch was last updated by Sun : Apr/23/11

AM 7.0_x86: Sun Java System Access Manager 2005Q4.
Date this patch was last updated by Sun : Nov/03/10

Sun Java System Access Manager 7.1 Solaris.
Date this patch was last updated by Sun : Apr/23/11

AM 7.0: Sun Java System Access Manager 2005Q4.
Date this patch was last updated by Sun : Nov/03/10

The remote host is running a version of Sun Java System Access Manager 7.1 earlier than Patch 3.  Such versions are potentially affected by multiple issues :

  - A vulnerability related to the CDCServlet component may result in policy advice being presented to the wrong client. (1-66-25968-1)

  - The software amy disclose clear text passwords in debug files when the debug flag is enabled. A local unprivileged user could gain unauthorized access to user identities.

  - A vulnerability may exist when the server processes specially crafted XML documents which may allow an attacker to crash the service or possibly execute arbitrary code.

AM 7.0_x86: Sun Java System Access Manager 2005Q4.
Date this patch was last updated by Sun : Nov/03/10

This plugin has been deprecated and either replaced with individual 120955 patch-revision plugins, or deemed non-security related.

AM 7.0: Sun Java System Access Manager 2005Q4.
Date this patch was last updated by Sun : Nov/03/10

This plugin has been deprecated and either replaced with individual 120954 patch-revision plugins, or deemed non-security related.

Sun Java System Access Manager 7.1 Solaris_x86.
Date this patch was last updated by Sun : Jun/19/09

Sun Java System Access Manager 7.1 Solaris.
Date this patch was last updated by Sun : Jun/19/09

ID	Name	Product	Family	Severity
107950	Solaris 10 (x86) : 126357-06	Nessus	Solaris Local Security Checks	critical
107871	Solaris 10 (x86) : 120955-12	Nessus	Solaris Local Security Checks	critical
107450	Solaris 10 (sparc) : 126356-06	Nessus	Solaris Local Security Checks	critical
107369	Solaris 10 (sparc) : 120954-12	Nessus	Solaris Local Security Checks	critical
5133	Sun Java System Access Manager 7.1 < Patch 3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
38126	Solaris 10 (x86) : 120955-12 (deprecated)	Nessus	Solaris Local Security Checks	critical
38005	Solaris 9 (x86) : 120955-12	Nessus	Solaris Local Security Checks	critical
37533	Solaris 9 (sparc) : 120954-12	Nessus	Solaris Local Security Checks	critical
37271	Solaris 8 (sparc) : 120954-12	Nessus	Solaris Local Security Checks	critical
36756	Solaris 10 (sparc) : 120954-12 (deprecated)	Nessus	Solaris Local Security Checks	critical
30010	Solaris 5.10 (x86) : 126357-03	Nessus	Solaris Local Security Checks	critical
30007	Solaris 5.10 (sparc) : 126356-03	Nessus	Solaris Local Security Checks	critical

Detections

Analytics

CVE-2009-2713

high

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical