Unauthenticated File Retrieval on Sun Java System Identity Manager

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052381 漏洞类型
发布时间 2008-11-20 更新时间 2008-11-20
漏洞平台 N/A CVSS评分 N/A
PR08-09: Unauthenticated File Retrieval on Sun Java System Identity
Manager "ext" parameter

Date Found: 25th April 2008

Vendor Contacted: 28th April 2008

Date Public: 10th November 2008

Severity: High

Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com).

ProCheckUp thanks Sun for working with us.


Sun Java System Identity Manager is vulnerable to *unauthenticated* file
retrieval a.k.a. directory traversal within the "ext" parameter
processed by the "/idm/includes/helpServer.jsp" server-side script.


Any files can be retrieved from the target server provided that the
attacker knows its location on the filesystem. No authentication is
required to exploit this vulnerability.

Proof of concept (PoC):

_Due to the severity of this issue, ProCheckUp will keep the PoC private
until all Sun Identity Manager customers are given enough time to update._

Successfully tested on:

Server environment:

Windows Server 2003, Standard
Apache Tomcat/5.0.28
Sun Java System Identity Manager 6.0 (20061212 SP 2)

Note: the version of Sun Java SIM can be obtained from the HTML source
code of the user login page: "/idm/user/login.jsp"



<a onmouseover="return overlib('Open <b>Help</b><br>Version &nbsp;Sun
Java System Identity Manager 6.0 (20061212 SP 2)',
        FGCOLOR, '#F5F5DC',
        BGCOLOR, '#000000',
        DELAY, '750')"




Apply the patches released by Sun. This vulnerability has been filed as
Sun Bugzilla bug 18653.

For more information please see


Copyright 2008 ProCheckUp Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if the Bulletin is not changed or edited in any way, is attributed
to ProCheckUp indicating this web page URL, and provided such
reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. ProCheckUp is not
liable for any misuse of this information by any third party. ProCheckUp
is not responsible for the content of external Internet sites.