PT-2012-1517 · Telelogic+1 · Telelogic License Server+2

Luigi Auriemma · Published 2012-01-19 · Updated 2017-08-17 · CVE-2011-1389

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Telelogic License Server version 2.0 Rational License Server versions 7.x IBM Rational License Key Server (RLKS) versions 8.0 through 8.1.2

Description The issue concerns directory traversal vulnerabilities in the vendor daemon of Rational Common Licensing, allowing remote attackers to execute arbitrary code. This is achieved through vectors related to save, rename, and load operations on log files.

Recommendations For Telelogic License Server version 2.0, update to a version that addresses the directory traversal vulnerabilities. For Rational License Server versions 7.x, apply the necessary patches or updates to fix the issue. For IBM Rational License Key Server (RLKS) versions 8.0 through 8.1.2, consider restricting access to log file operations until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-1389

Affected Products

Ibm Rational License Key Server

Rational License Server

Telelogic License Server

References · 9

• http://secunia.com/advisories/47524 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg21577760 · Vendor Advisory
• http://secunia.com/advisories/47522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1389 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71739 · Note
• http://securityfocus.com/bid/49191 · Note
• http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1 · Note
• http://zerodayinitiative.com/advisories/ZDI-11-272 · Note
• http://flexerasoftware.com/pl/13057.htm · Note