PT-2011-1333 · Ibm · Ibm Tivoli Federated Identity Manager

Published 2011-08-12 · Updated 2012-04-25 · CVE-2009-5084

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.0 through 6.2.0.2 (excluding 6.2.0.2)

Description The issue allows local users to potentially obtain sensitive information by reading log data when a specific tracing feature is enabled. This could lead to the exposure of passwords.

Recommendations For IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.0 through 6.2.0.1, update to version 6.2.0.2 to resolve the issue. As a temporary workaround, consider disabling the com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing feature until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-5084

Affected Products

Ibm Tivoli Federated Identity Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2009-5084 · Security Note
• http://ibm.com/support/docview.wss?uid=swg24029497 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44560 · Patch, Vendor Advisory