Sun has reported a vulnerability in Sun Java System Directory Server, which could give remote users administrative access to the console.

When the Directory Server is installed, the administration password is stored in "/admin-serv/config/admpw". This could allow any local or remote user to access the Directory Server console to gain access to the Directory Server with administrator rights.

This flaw affects Sun Java System Directory Server 5.2 under any platforms. No security update has been published to fix this issue, since users simply have to manually change the administrator password set during initial installation to avoid the vulnerability. This measure, described in the Sun advisory, can be carried out through the administration console or from the command line.

The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102345-1.