CVE-2009-1083: sun java_system_identity_manager Code Injection

Vulnerability summary

CVE-2009-1083 is a high (CVSS 9.0) Code Injection vulnerability in sun java_system_identity_manager. EPSS estimates a 3.68% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.

Timeline

1. 25-03-2009
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.