PT-2009-3482 · Ibm · Ibm Websphere Application Server

Published 2009-03-25 · Updated 2017-08-17 · CVE-2009-0891

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.0.2 through 6.0.2.32 IBM WebSphere Application Server versions 6.1 through 6.1.0.22 IBM WebSphere Application Server versions 7.0 through 7.0.0.0

Description The issue is related to the Web Services Security component, which does not properly enforce nonce and timestamp expiration values in WS-Security bindings. This allows remote authenticated users to conduct session hijacking attacks.

Recommendations For IBM WebSphere Application Server versions 6.0.2 through 6.0.2.32, apply Fix Pack 33 (6.0.2.33) to resolve the issue. For IBM WebSphere Application Server versions 6.1 through 6.1.0.22, apply Fix Pack 23 (6.1.0.23) to resolve the issue. For IBM WebSphere Application Server versions 7.0 through 7.0.0.0, apply Fix Pack 1 (7.0.0.1) to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0891

Affected Products

Ibm Websphere Application Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-0891 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951 · Patch
• http://www-1.ibm.com/support/search.wss?rs=0&q=PK66676&apar=only · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg27006876 · Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463 · Patch
• http://secunia.com/advisories/34131 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0891 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49391 · Note