PT-2010-5560 · Ibm · Ibm Lotus Mobile Connect

Published 2010-12-22 · Updated 2011-01-11 · CVE-2010-4593

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM Lotus Mobile Connect versions prior to 6.1.4

Description The issue is related to the Connection Manager in IBM Lotus Mobile Connect, which does not properly maintain a certain reference count. This allows remote authenticated users to cause a denial of service, specifically IP address exhaustion, by making invalid attempts to establish sessions with the same VPN ID from multiple devices.

Recommendations For versions prior to 6.1.4, update to version 6.1.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-4593

Affected Products

Ibm Lotus Mobile Connect

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-4593 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ75012 · Vendor Advisory
• http://secunia.com/advisories/42703 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27020327 · Note