PT-2009-3094 · Ibm · Ibm Websphere Partner Gateway

Published 2009-02-22 · Updated 2017-08-08 · CVE-2009-0440

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Partner Gateway (WPG) versions 6.0.0 through 6.0.0.7

Description The issue is related to the improper handling of signature verification failures, which could allow remote authenticated users to submit a crafted RosettaNet (RNIF) document to a backend application. This is related to altered service content and digital signature foot-print.

Recommendations For IBM WebSphere Partner Gateway (WPG) versions 6.0.0 through 6.0.0.7, consider implementing additional validation checks on RosettaNet (RNIF) documents to prevent the submission of crafted documents. As a temporary workaround, restrict access to backend applications that process these documents until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0440

Affected Products

Ibm Websphere Partner Gateway

References · 6

• http://secunia.com/advisories/33994 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1JR31231 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21330341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0440 · Security Note
• http://securityfocus.com/bid/33839 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48530 · Note