PT-2009-4983 · Ibm · Ibm Tivoli Identity Manager

Published 2009-07-23 · Updated 2009-08-04 · CVE-2009-2583

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Tivoli Identity Manager version 5.0.0.6

Description The issue involves multiple session fixation vulnerabilities that can be exploited by remote attackers to hijack web sessions. This is achieved through unspecified vectors involving the console and self-service interfaces.

Recommendations For IBM Tivoli Identity Manager version 5.0.0.6, consider restricting access to the console and self-service interfaces until a fix is available. As a temporary workaround, disabling the affected interfaces may help minimize the risk of session hijacking. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-2583

Affected Products

Ibm Tivoli Identity Manager

References · 7

• http://securityfocus.com/bid/35779 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2583 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55659 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg24023826 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1990 · Vendor Advisory
• http://secunia.com/advisories/35931 · Vendor Advisory
• http://securitytracker.com/id?1022597 · Note