PT-2009-3482 · Ibm · Ibm Websphere Application Server

Publicado 2009-03-25 · Atualizado 2017-08-17 · CVE-2009-0891

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.0.2 through 6.0.2.32 IBM WebSphere Application Server versions 6.1 through 6.1.0.22 IBM WebSphere Application Server versions 7.0 through 7.0.0.0

Description The issue is related to the Web Services Security component, which does not properly enforce nonce and timestamp expiration values in WS-Security bindings. This allows remote authenticated users to conduct session hijacking attacks.

Recommendations For IBM WebSphere Application Server versions 6.0.2 through 6.0.2.32, apply Fix Pack 33 (6.0.2.33) to resolve the issue. For IBM WebSphere Application Server versions 6.1 through 6.1.0.22, apply Fix Pack 23 (6.1.0.23) to resolve the issue. For IBM WebSphere Application Server versions 7.0 through 7.0.0.0, apply Fix Pack 1 (7.0.0.1) to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0891

Produtos afetados

Ibm Websphere Application Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-0891 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951 · Correção
• http://www-1.ibm.com/support/search.wss?rs=0&q=PK66676&apar=only · Aviso do Fabricante
• http://secunia.com/advisories/34131 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0891 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49391 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg27006876 · Correção
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463 · Correção