PT-2009-4540 · Ibm · Ibm Websphere Application Server

Published 2009-08-13 · Updated 2017-08-17 · CVE-2009-2087

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.25 IBM WebSphere Application Server versions 7.0 before 7.0.0.5

Description The issue involves weak password obfuscation in the Web Services functionality of IBM WebSphere Application Server, specifically under certain circumstances with the ibm-webservicesclient-bind.xmi file and custom password encryption. This weakness can be exploited by local users to cause a denial of service, resulting in deployment failure, via unspecified vectors.

Recommendations For IBM WebSphere Application Server version 6.1 before 6.1.0.25, update to version 6.1.0.25 or later. For IBM WebSphere Application Server version 7.0 before 7.0.0.5, update to version 7.0.0.5 or later.

Fix

DoS

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-2087

Affected Products

Ibm Websphere Application Server

References · 7

• http://www-1.ibm.com/support/docview.wss?uid=swg1PK79275 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2087 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2087 · Note
• http://secunia.com/advisories/34461 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52078 · Note