PT-2007-5326 · Hitachi · Cosminexus Component Container+1

Published 2007-08-01 · Updated 2017-07-29 · CVE-2007-4124

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cosminexus versions prior to 20070731 Cosminexus Component Container in Cosminexus 6 Cosminexus Component Container in Cosminexus 6.7 Cosminexus Component Container in Cosminexus 7

Description The issue concerns the session failover function in Cosminexus Component Container. Under unspecified conditions, it can use session data for the wrong user. This might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.

Recommendations For Cosminexus versions prior to 20070731, update to a version released after 20070731 to resolve the issue. For Cosminexus 6, consider disabling the session failover function until a patch is available. For Cosminexus 6.7, restrict access to sensitive information to minimize the risk of exploitation. For Cosminexus 7, avoid using the session failover function in multi-user environments until the issue is resolved.

Fix

Related Identifiers

CVE-2007-4124

Affected Products

Cosminexus

Cosminexus Component Container

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4124 · Security Note
• http://hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html · Vendor Advisory
• http://secunia.com/advisories/26250 · Vendor Advisory
• http://vupen.com/english/advisories/2007/2725 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35706 · Note
• http://osvdb.org/37852 · Note
• http://securityfocus.com/bid/25145 · Note