PT-2009-3732 · Ibm · Ibm Websphere Application Server

Published 2009-03-31 · Updated 2014-10-24 · CVE-2009-1173

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server (WAS) versions 7.0.0 through 7.0.0.2

Description The issue is related to weak permissions used by IBM WebSphere Application Server for files associated with interim fixes. Specifically, the software uses 777 permissions instead of the intended 755 permissions, allowing attackers to modify files that should be inaccessible.

Recommendations For IBM WebSphere Application Server (WAS) versions 7.0.0 through 7.0.0.2, update to version 7.0.0.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1173

Affected Products

Ibm Websphere Application Server

References · 9

• http://vupen.com/english/advisories/2009/0854 · Vendor Advisory
• http://secunia.com/advisories/34461 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PK77590 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PK82988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1173 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463 · Patch
• http://securityfocus.com/bid/34259 · Note
• http://secunia.com/advisories/34131 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1173 · Note