Vulnerability CVE-2009-0348 - CERT Civis.Net

Vulnerability Name:

CVE-2009-0348 (CCN-48283)

Assigned:

2009-01-27

Published:

2009-01-27

Updated:

2017-08-08

Summary:

The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2009-0348

Source: CCN
Type: SA33688
Sun Java System Access Manager User Enumeration Weakness

Source: SECUNIA
Type: Vendor Advisory
33688

Source: CONFIRM
Type: Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1

Source: CCN
Type: Sun Alert ID: 242026
A Security Vulnerability in Sun Java System Access Manager May Allow a Remote Unprivileged User to Determine the Existence of "guessed" Usernames

Source: SUNALERT
Type: Patch, Vendor Advisory
242026

Source: CCN
Type: ASA-2009-044
A Security Vulnerability in Sun Java System Access Manager May Allow a Remote Unprivileged User to Determine the Existence of "guessed" Usernames (Sun 242026)

Source: CCN
Type: OSVDB ID: 51666
Sun Java System Access Manager Login Module User Account Enumeration Weakness

Source: BID
Type: UNKNOWN
33489

Source: CCN
Type: BID-33489
Sun Java System Access Manager Username Enumeration Weakness

Source: VUPEN
Type: UNKNOWN
ADV-2009-0269

Source: XF
Type: UNKNOWN
sun-jsam-username-info-disclosure(48283)

Source: XF
Type: UNKNOWN
sun-jsam-username-info-disclosure(48283)

Vulnerable Configuration:

Configuration 1:

cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_10_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_10_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_10_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_10_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_8_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_8_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_8_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_8_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_9_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_9_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_9_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.1:*:solaris_9_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_10_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_10_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_10_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_10_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_8_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_8_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_8_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_8_x86:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_9_linux:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_9_sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_9_windows:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7_2005q4:*:solaris_9_x86:*:*:*:*:*

Configuration CCN 1:

cpe:/a:sun:java_system_access_manager:7.1:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:7.0_2005q4:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_access_manager:6.3_2005q1::solaris_10_linux:*:*:*:*:*

AND

cpe:/o:sun:solaris:8::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:9::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

Denotes that component is vulnerable