PT-2009-4983 · Ibm · Ibm Tivoli Identity Manager

Publicado 2009-07-23 · Atualizado 2009-08-04 · CVE-2009-2583

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Tivoli Identity Manager version 5.0.0.6

Description The issue involves multiple session fixation vulnerabilities that can be exploited by remote attackers to hijack web sessions. This is achieved through unspecified vectors involving the console and self-service interfaces.

Recommendations For IBM Tivoli Identity Manager version 5.0.0.6, consider restricting access to the console and self-service interfaces until a fix is available. As a temporary workaround, disabling the affected interfaces may help minimize the risk of session hijacking. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-2583

Produtos afetados

Ibm Tivoli Identity Manager

Referências · 7

• http://securityfocus.com/bid/35779 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-2583 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55659 · Aviso do Fabricante
• http://securitytracker.com/id?1022597 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg24023826 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1990 · Aviso do Fabricante
• http://secunia.com/advisories/35931 · Aviso do Fabricante