Description
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
References
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
- 253267 vendor-advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
- 1021881 vdb-entry
- 34191 vdb-entry
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
- ADV-2009-0797 vdb-entry
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
- 34380 third-party-advisory