Solaris 5.10 (x86) : 126357-03

Sun Java System Access Manager 7.1 Solarisx86. Date this patch was last updated by Sun : Jun/19/09 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Sun Java系统访问管理器多个安全漏洞

BUGTRAQ ID: 25842 Sun Java系统访问管理器是一个安全单点登录、认证、授权解决方案。 Sun Java系统访问管理器实现上存在多个漏洞，远程攻击者可能利用这些漏洞实现非授权访问。 如果在Sun Java系统应用服务器9.1容器中安装了Sun Java系统访问管理器7.1且重启了容器，就不会显示认证屏。任何基于认证使用容器的应用程序都无法正确运行，因为任何用户都会未经认证便给予访问。这可能导致非特权的非管理用户执行管理任务，例如，管理控制台在访问这个应用时不再提示用户进行认证。因此，任何用户无论是否拥有管理权限，都可以管理应用服务器。 在Sun...

Code injection

Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors...

Authentication flaw

Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 9.1 container, does not demand authentication after a container restart, which allows remote attackers to perform administrative tasks...

CVE-2007-5152

Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 9.1 container, does not demand authentication after a container restart, which allows remote attackers to perform administrative tasks...

CVE-2007-5153

Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2007-5152

Summary: CVE-2007-5152 affects Sun Java System Access Manager 7.1 when installed in a Sun Java System Application Server 9.1 container. The issue is that authentication is not required after a container restart, enabling remote attackers to perform administrative tasks. The vulnerability is evide...

CVE-2007-5152

Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 9.1 container, does not demand authentication after a container restart, which allows remote attackers to perform administrative tasks...

CVE-2007-5153

Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2007-5153

Technical details about CVE-2007-5153 are not publicly available in the provided documents; affected products, impact, and remediation specifics are not disclosed. Monitor for updates from official sources.

Sun Java System Access Manager密码信息泄露漏洞

Sun Java System Access Manager是一款为企业提供了身份联合方面的一个可互操作、基于标准的强大验证和授权解决方案。 Sun Java System Access Manager存在设计错误，本地攻击者可以利用漏洞获得用户密码敏感信息。 当在Sun Java System Access Manager的调试级别如果设置为"message"，登录密码会以明文方式记录，因此本地非特权用户可读取。 Sun Java System Access Manager 6.2 2004Q2 Solaris x Sun Java System Access Manager 6.2...

Design/Logic Flaw

Sun Java System Access Manager formerly Java System Identity Server before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading...

CVE-2007-3700

Sun Java System Access Manager formerly Java System Identity Server before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading...

CVE-2007-3700

CVE-2007-3700 affects Sun Java System Access Manager (formerly Java System Identity Server) prior to 20070710. When AMConfig.properties sets com.iplanet.services.debug.level to a debug value, the product logs cleartext login passwords to /var/opt/SUNWam/debug/amAuth, enabling a local user to read...

CVE-2007-3700

Sun Java System Access Manager formerly Java System Identity Server before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading...

Cross site request forgery (csrf)

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2007-3570

The CVE-2007-3570 issue affects the Linux Access Gateway component of Novell Access Manager prior to 3.0 SP1 Release Candidate 1. The vulnerability allows remote attackers to bypass unspecified security controls by sending Fullwidth/Halfwidth Unicode encoded data in an HTTP POST request. Document...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

Novell Access Manager SSLVPN服务器policy.txt绕过安全限制漏洞

Novell Access Manager是一个综合的Web访问管理解决方案。 Novell Access Manager在认证机制的实现上存在漏洞，客户端可能利用此漏洞绕过必要的认证获取非授权访问。 工作站连接到SSLVPN服务器并在IE中下载了ActiveX控件后，会在用户目录下创建policy.txt文件，包含有说明哪些通讯和端口可以通过VPN的规则。 如果用户将这个文件设置为只读，之后断开，然后在重新连接之前手动编辑该文件的话，就可以访问企业LAN中的任意资源。例如，更改文件包含以下内容： sslize from : 0.0.0.0 / 0 to...