A security issue has been reported in Sybase EAServer, which can be exploited by malicious, local users to disclose potentially sensitive information.

The security issue is caused due to clear text passwords being returned by the "getSelectedText()" method of the "javax.swing.JPasswordField" UI component. This can potentially be exploited to disclose the password that has been input into the password field.

Successful exploitation requires that e.g. a user keys in his password into a password prompt dialog box in a GUI application and leaves dialog box open, or the attacker has access to the file that stores private data from the JPasswordField UI component.

The security issue has been reported in the following versions:
* EAServer version 5.0 (HP-UX Itanium)
* EAServer version 5.2 (IBM AIX/HP-UX PA-RISC/Linux x86/Sun Solaris SPARC)

Note: The security issue affects users who develop and deploy their own J2EE Application Clients and Java GUI applications with EAServer using the javax.swing.JPasswordField UI component. GUI applications built by other vendors may also be affected.

Solution
Update to the fixed version or install EBF.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://www.sybase.com/detail?id=1040665

Deep Links
Links available in Customer Area