PT-2009-3094 · Ibm · Ibm Websphere Partner Gateway

Publicado 2009-02-22 · Atualizado 2017-08-08 · CVE-2009-0440

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Partner Gateway (WPG) versions 6.0.0 through 6.0.0.7

Description The issue is related to the improper handling of signature verification failures, which could allow remote authenticated users to submit a crafted RosettaNet (RNIF) document to a backend application. This is related to altered service content and digital signature foot-print.

Recommendations For IBM WebSphere Partner Gateway (WPG) versions 6.0.0 through 6.0.0.7, consider implementing additional validation checks on RosettaNet (RNIF) documents to prevent the submission of crafted documents. As a temporary workaround, restrict access to backend applications that process these documents until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0440

Produtos afetados

Ibm Websphere Partner Gateway

Referências · 6

• http://securityfocus.com/bid/33839 · Nota
• http://secunia.com/advisories/33994 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1JR31231 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48530 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21330341 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0440 · Nota de Segurança