Some vulnerabilities and security issues have been reported in Sun Java System Identity Manager, which can be exploited by by malicious users to bypass certain security restrictions and compromise a vulnerable system, and by malicious people to disclose sensitive information, conduct cross-site scripting attacks, bypass certain security restrictions, manipulate certain data, or potentially compromise a vulnerable system.

1) An unspecified error can lead to unencrypted communication between clients and the IDM server.

2) Different error messages are returned depending on whether an unsuccessful login attempt is performed with a valid or invalid username.

3) An unspecified error can be exploited to change another user's password.

4) An unspecified error can be exploited to perform certain actions that are expected to be restricted.

Successful exploitation requires a valid user account.

5) Unspecified input is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

6) An unspecified error can be exploited to submit arbitrary commands to the Admin Console and perform administrative actions e.g. creating accounts.

Successful exploitation requires a valid user account.

7) An error in the processing of password change requests can be exploited to inject and execute arbitrary commands on Unix / Linux based resource adapters via a new line (%0a) character.

8) An unspecified error can be exploited to modify IDM system configuration data.

The vulnerabilities are reported in Sun Java System Identity Manager 7.0, 7.1, 7.1.1, and 8.0.

NOTE: Version 8.1 is reportedly not affected.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
2) Marco Mella
7) Alexandre Bezroutchko of Scanit

The vendor credits:
5) Dan Sinclair of Security Compass and ProCheckUp Ltd.

Changelog
Further details available in Customer Area

Original Advisory
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1

Marco Mella:
http://www.webalice.it/marco.mella/AboutSecurity/AboutSecurity_Advisory/Entries/2009/4/2_Sun_Java_System_Identiy_Manager_Users_enumeration.html

Scanit:
http://www.scanit.be/en_US/advisory-2009-05-12.html

Deep Links
Links available in Customer Area