PT-2014-2646 · Ibm · Ibm Sametime

Publicado 2014-05-26 · Atualizado 2017-08-29 · CVE-2013-3046

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:A/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.x through 8.5.2.1 IBM Sametime versions 9.x through 9.0.0.1

Description The issue concerns the Meeting Server in IBM Sametime, which fails to send the HSTS Strict-Transport-Security header. This omission makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests.

Recommendations For IBM Sametime versions 8.x through 8.5.2.1, update to a version that includes the fix for this issue. For IBM Sametime versions 9.x through 9.0.0.1, update to a version that includes the fix for this issue. As a temporary workaround, consider configuring the server to send the HSTS Strict-Transport-Security header to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-3046

Produtos afetados

Ibm Sametime

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-3046 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84819 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21671201 · Aviso do Fabricante