:Two security issues have been reported in Sun Java System Access Manager, which can be exploited by malicious people to bypass certain security restrictions.1) An unspecified error in Sun Java System Access Manager can cause container-based authentication to work incorrectly. This can be exploited to access administrative applications, e.g. the Admin Console.Successful exploitation requires that Sun Java System Access Manager is installed in a Sun Java System Application Server 9.1 container and the container is restarted.2) An unspecified error in Sun Java System Access Manager can potentially be exploited to execute arbitrary code with the privileges of a deployed application.Successful exploitation requires that Sun Java Access Manager is installed in a Sun Java System Application Server 8.x container.The security issues are reported in Sun Java Access Manager 7.1 for Solaris 8, 9, and 10 for both the SPARC and x86 platforms, and for Linux, Windows, and HP-UX.Solution:The vendor recommends editing the "server.policy" file (please see vendor advisory for details).A final resolution is reportedly pending completion.Provided and/or discovered by:Reported by the vendor.Original Advisory:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103069-1Extended Solution:The “Extended Solution” section is available for Secunia customers only. Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.

Original post by pooja