PT-2014-7063 · Ibm · Ibm Tivoli Endpoint Manager - Mobile Device Management

Publicado 2014-12-06 · Atualizado 2018-10-09 · CVE-2014-6140

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager Mobile Device Management (MDM) versions prior to 9.0.60100

Description The issue allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to various endpoints, including (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal. This is due to the use of the same secret HMAC token across different customers' installations.

Recommendations For versions prior to 9.0.60100, update to version 9.0.60100 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoints, such as the Enrollment and Apple iOS Management Extender, Self-service portal, Trusted Services provider, and Admin Portal, until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-6140

Produtos afetados

Ibm Tivoli Endpoint Manager - Mobile Device Management

Referências · 8

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components · Exploit
• 🔥 http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-6140 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21691701 · Aviso do Fabricante
• http://securityfocus.com/archive/1/534131/100/0/threaded · Nota
• http://securitytracker.com/id/1031306 · Nota
• http://securityfocus.com/bid/71424 · Nota