Technical Description

A vulnerability has been identified in Sun Ray Server Software, which could be exploited by local attackers to gain knowledge of sensitive information. This issue is due to an error in the authentication and logging process, which could be exploited by malicious users with a read access to the Sun Ray private web server's logfile or to a similar logfile on a proxy server to obtain the administrator's (utadmin) password when the administrator logs in to the Sun Ray Administration Tool.

Affected Products

Sun Ray Server Software version 2.0
Sun Ray Server Software version 3.0

Solution

Sun Ray Server Software 2.0 (SPARC) - Apply patch 114880-10 or later
Sun Ray Server Software 3.0 (SPARC) - Apply patch 118979-02 or later
Sun Ray Server Software 3.0 (Linux) - Apply patch 119836-02 or later

References

http://www.vupen.com/english/advisories/2007/0316
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102779-1

Credits

Vulnerabilities reported by the vendor

ChangeLog

2007-01-24 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.