CVE-2009-1083

CriticalCVSS 9.0/10Last modified Jun 16, 2026

Description

Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."

Metrics

CVSS 2.0 9.0/10AV:N/AC:L/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blogs.sun.com/security/entry/sun_alert_253267_sun_javaPatch, Vendor Advisory
http://secunia.com/advisories/34380Vendor Advisory
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1Patch, Vendor Advisory
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797Vendor Advisory
http://blogs.sun.com/security/entry/sun_alert_253267_sun_javaPatch, Vendor Advisory
http://secunia.com/advisories/34380Vendor Advisory
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1Patch, Vendor Advisory
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797Vendor Advisory

Timeline

Published: Mar 25, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-10846.4Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows re CVE-2009-10855.0Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to CVE-2009-10866.4Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service (CVE-2009-10879.3Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via CVE-2009-10889.0Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted CVE-2009-10895.0Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a b CVE-2009-10906.8Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary lo CVE-2009-10914.3Cross-site scripting (XSS) vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web scri CVE-2009-10929.3Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote at CVE-2009-10935.0LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and e CVE-2009-109410.0Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and e CVE-2009-109510.0Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12