PT-2010-2510 · Ibm · Ibm Websphere Application Server

Published 2010-05-17 · Updated 2017-08-17 · CVE-2010-0777

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.0 through 6.0.2.43 IBM WebSphere Application Server versions 6.1 through 6.1.0.31 IBM WebSphere Application Server versions 7.0 through 7.0.0.11

Description The issue concerns the Web Container in IBM WebSphere Application Server, which does not properly handle long filenames. This results in the server sending an incorrect file in some responses, allowing remote attackers to obtain sensitive information by reading the retrieved file.

Recommendations For IBM WebSphere Application Server versions 6.0 through 6.0.2.43, update to version 6.0.2.43 or later. For IBM WebSphere Application Server versions 6.1 through 6.1.0.31, update to version 6.1.0.31 or later. For IBM WebSphere Application Server versions 7.0 through 7.0.0.11, update to version 7.0.0.11 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0777

Affected Products

Ibm Websphere Application Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-0777 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM06111 · Vendor Advisory
• http://securityfocus.com/bid/40277 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951 · Note
• http://vupen.com/english/advisories/2010/1200 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58557 · Note
• http://secunia.com/advisories/39838 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0777 · Note