CVE-2009-2713

MEDIUM 4.3CVE-2009-2713 · Published 07/08/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
java system access manager sun	`= 6.3_2005q1= 7.0_2005q4= 7.1= 7_2005q4`	No fix yet
java system web server sun	`= 7.0`	No fix yet

Description

The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.

References

secunia.com/advisories/36167 · Vendor Advisory
sunsolve.sun.com/search/document.do · Patch
sunsolve.sun.com/search/document.do · Vendor Advisory
securityfocus.com/bid/35961 · Patch
vupen.com/english/advisories/2009/2176

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free