PT-2012-1517 · Telelogic+1 · Telelogic License Server+2

Luigi Auriemma · Publicado 2012-01-19 · Atualizado 2017-08-17 · CVE-2011-1389

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Telelogic License Server version 2.0 Rational License Server versions 7.x IBM Rational License Key Server (RLKS) versions 8.0 through 8.1.2

Description The issue concerns directory traversal vulnerabilities in the vendor daemon of Rational Common Licensing, allowing remote attackers to execute arbitrary code. This is achieved through vectors related to save, rename, and load operations on log files.

Recommendations For Telelogic License Server version 2.0, update to a version that addresses the directory traversal vulnerabilities. For Rational License Server versions 7.x, apply the necessary patches or updates to fix the issue. For IBM Rational License Key Server (RLKS) versions 8.0 through 8.1.2, consider restricting access to log file operations until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-1389

Produtos afetados

Ibm Rational License Key Server

Rational License Server

Telelogic License Server

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/71739 · Nota
• http://securityfocus.com/bid/49191 · Nota
• http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1 · Nota
• http://secunia.com/advisories/47524 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg21577760 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-11-272 · Nota
• http://secunia.com/advisories/47522 · Aviso do Fabricante
• http://flexerasoftware.com/pl/13057.htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1389 · Nota de Segurança