PT-2012-2833 · Ibm · Ibm Tivoli Event Pump

Publicado 2012-04-09 · Atualizado 2017-08-29 · CVE-2012-0742

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Event Pump version 4.2.2

Description The issue allows local users to obtain sensitive information by reading the AOPSCLOG (aka AOPLOG) data set. This occurs when the LOG REQUESTS and VALIDATE SOAP USERS options are enabled, causing credentials to be placed into the AOPSCLOG data set.

Recommendations For IBM Tivoli Event Pump version 4.2.2, consider disabling the LOG REQUESTS and VALIDATE SOAP USERS options as a temporary workaround to prevent credentials from being logged to the AOPSCLOG data set. Restrict access to the AOPSCLOG data set to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-0742

Produtos afetados

Ibm Tivoli Event Pump

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/74641 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0742 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1OA38586 · Aviso do Fabricante