PT-2010-4859 · Tibco · Tibco Activematrix Service Bus+3

Published 2010-10-26 · Updated 2017-08-17 · CVE-2010-3491

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO ActiveMatrix Service Grid versions prior to 2.3.1 TIBCO ActiveMatrix Service Bus versions prior to 2.3.1 TIBCO ActiveMatrix BusinessWorks Service Engine versions prior to 5.8.1 TIBCO ActiveMatrix Service Performance Manager versions prior to 1.3.2

Description The issue is related to the improper handling of JMX connections by the ActiveMatrix Runtime and ActiveMatrix Administrator components. This allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service via unspecified vectors.

Recommendations For TIBCO ActiveMatrix Service Grid versions prior to 2.3.1, update to version 2.3.1 or later. For TIBCO ActiveMatrix Service Bus versions prior to 2.3.1, update to version 2.3.1 or later. For TIBCO ActiveMatrix BusinessWorks Service Engine versions prior to 5.8.1, update to version 5.8.1 or later. For TIBCO ActiveMatrix Service Performance Manager versions prior to 1.3.2, update to version 1.3.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-3491

Affected Products

Tibco Activematrix Businessworks Service Engine

Tibco Activematrix Service Bus

Tibco Activematrix Service Grid

Tibco Activematrix Service Performance Manager

References · 7

• http://tibco.com/services/support/advisories/activematrix-advisory_20101019.jsp · Vendor Advisory
• http://secunia.com/advisories/41891 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2747 · Vendor Advisory
• http://tibco.com/multimedia/activematrix_advisory_tcm8-12488.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3491 · Security Note
• http://securityfocus.com/bid/44254 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62674 · Note