PT-2010-4626 · Ibm · Ibm Websphere Application Server+1

Publicado 2010-08-30 · Atualizado 2017-08-17 · CVE-2010-3186

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x before 7.0.0.13 IBM WebSphere Application Server Feature Pack for Web Services versions 6.1.0.9 through 6.1.0.32

Description The issue is related to the handling of the IncludeTimestamp setting in the WS-Security policy when a JAX-WS application is used. This has unspecified impact and allows for remote attack vectors.

Recommendations For IBM WebSphere Application Server versions 7.x before 7.0.0.13, update to version 7.0.0.13 or later. For IBM WebSphere Application Server Feature Pack for Web Services versions 6.1.0.9 through 6.1.0.32, update to a version outside of this range.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-3186

Produtos afetados

Ibm Websphere Application Server

Ibm Websphere Application Server Feature Pack For Web Services

Referências · 11

• http://secunia.com/advisories/41173 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2215 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3186 · Nota
• http://osvdb.org/67570 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg24027708 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg24027709 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61435 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21443736 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3186 · Nota de Segurança