Sun Java System Directory Proxy Server Bug Lets Remote Authenticated Users Gain Administrative Privileges
|
|
SecurityTracker Alert ID: 1019925
|
|
SecurityTracker URL: http://securitytracker.com/id?1019925
|
|
CVE Reference: CVE-2008-1995
(Links to External Site)
|
Updated: May 5 2008
|
Original Entry Date: Apr 27 2008
|
Impact: User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): 6.0, 6.1, 6.2
|
Description: A vulnerability was reported in Sun Java System Directory Proxy Server. A remote authenticated user can gain elevated privileges on the target application.
The system does not properly classify connections based on the bind DN criteria and may apply the wrong policy. As a result, a remote authenticated user can obtain administrative privileges.
Version 5.2 is not affected.
|
Impact: A remote authenticated user can gain administrative privileges on the target application.
|
Solution: The vendor has issued a fixed version (6.3). The vendor has also issued the following patches.
Native Package Versions:
* Solaris 9 and 10 SPARC patch 125276-07 or later
* Solaris 9 x86 patch 125277-07 or later
* Solaris 10 x86 and x64
patch 125278-07 or later
* Linux patch 125309-07 or later
PatchZIP (Compressed Archive) versions:
* Solaris 9 and
10 SPARC patch 126748-04 or later
* Solaris 9 x86 patch 126749-04 or later
* Solaris 10 x86 and x64 patch 126750-04 or
later
* Linux patch 126751-04 or later
* Windows patch 126753-04 or later
* HP-UX patch 126752-04 or later
Note:
The above patches can be installed on any impacted release to upgrade it to version 6.3, thereby resolving this issue.
For more
information on the upgrade process please see the following:
Directory Server 6.3 Release Notes are available at:
http://docs.sun.com/app/docs/doc/820-2759
and
the Directory Server 6.3 Installation Guide is available at:
http://docs.sun.com/app/docs/doc/820-2761
The vendor's advisory
is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1 (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 27 Apr 2008 01:37:10 -0400
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1
|
[Original Message Not Available for Viewing]
|
|
