SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Directory)  >   Sun ONE Directory Server Vendors:   Sun
Sun Java System Directory Proxy Server Bug Lets Remote Authenticated Users Gain Administrative Privileges
SecurityTracker Alert ID:  1019925
SecurityTracker URL:  http://securitytracker.com/id/1019925
CVE Reference:   CVE-2008-1995   (Links to External Site)
Updated:  May 5 2008
Original Entry Date:  Apr 27 2008
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.0, 6.1, 6.2
Description:   A vulnerability was reported in Sun Java System Directory Proxy Server. A remote authenticated user can gain elevated privileges on the target application.

The system does not properly classify connections based on the bind DN criteria and may apply the wrong policy. As a result, a remote authenticated user can obtain administrative privileges.

Version 5.2 is not affected.

Impact:   A remote authenticated user can gain administrative privileges on the target application.
Solution:   The vendor has issued a fixed version (6.3). The vendor has also issued the following patches.

Native Package Versions:

* Solaris 9 and 10 SPARC patch 125276-07 or later
* Solaris 9 x86 patch 125277-07 or later
* Solaris 10 x86 and x64 patch 125278-07 or later
* Linux patch 125309-07 or later

PatchZIP (Compressed Archive) versions:

* Solaris 9 and 10 SPARC patch 126748-04 or later
* Solaris 9 x86 patch 126749-04 or later
* Solaris 10 x86 and x64 patch 126750-04 or later
* Linux patch 126751-04 or later
* Windows patch 126753-04 or later
* HP-UX patch 126752-04 or later

Note: The above patches can be installed on any impacted release to upgrade it to version 6.3, thereby resolving this issue.

For more information on the upgrade process please see the following:

Directory Server 6.3 Release Notes are available at:

http://docs.sun.com/app/docs/doc/820-2759

and the Directory Server 6.3 Installation Guide is available at:

http://docs.sun.com/app/docs/doc/820-2761

The vendor's advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1 (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC