PT-2012-2792 · Tibco · Tibco Businessevents Runtime+5

Published 2012-03-13 · Updated 2012-03-14 · CVE-2012-0687

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TIBCO ActiveMatrix Runtime Platform versions 2.x through 2.3.1 TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution version 3.1.3 TIBCO ActiveMatrix Platform in Service Grid and Service Bus versions 3.x through 3.1.4 TIBCO ActiveMatrix Platform in BusinessWorks Service Engine versions 5.9.x through 5.9.2 TIBCO ActiveMatrix Platform in BusinessWorks Service Engine version 5.8.1 and earlier TIBCO ActiveMatrix Platform in BPM versions prior to 1.3.0 TIBCO BusinessEvents Runtime in Enterprise and Inference Editions versions 3.x through 3.0.2 TIBCO BusinessEvents Runtime in Standard Edition versions 4.x through 4.0.1 TIBCO BusinessEvents Runtime in Standard Edition and Express version 5.0.0 TIBCO BusinessWorks Engine in TIBCO Silver Fabric ActiveMatrix BusinessWorks Distribution version 5.9.2 TIBCO BusinessWorks Engine in ActiveMatrix BusinessWorks versions prior to 5.9.3

Description The issue allows remote attackers to obtain sensitive information via a crafted URL.

Recommendations For TIBCO ActiveMatrix Runtime Platform versions 2.x through 2.3.1, update to version 2.3.2 or later. For TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution version 3.1.3, update to a version later than 3.1.3. For TIBCO ActiveMatrix Platform in Service Grid and Service Bus versions 3.x through 3.1.4, update to version 3.1.5 or later. For TIBCO ActiveMatrix Platform in BusinessWorks Service Engine versions 5.9.x through 5.9.2, update to version 5.9.3 or later. For TIBCO ActiveMatrix Platform in BusinessWorks Service Engine version 5.8.1 and earlier, update to version 5.8.2 or later. For TIBCO ActiveMatrix Platform in BPM versions prior to 1.3.0, update to version 1.3.0 or later. For TIBCO BusinessEvents Runtime in Enterprise and Inference Editions versions 3.x through 3.0.2, update to version 3.0.3 or later. For TIBCO BusinessEvents Runtime in Standard Edition versions 4.x through 4.0.1, update to version 4.0.2 or later. For TIBCO BusinessEvents Runtime in Standard Edition and Express version 5.0.0, update to a version later than 5.0.0. For TIBCO BusinessWorks Engine in TIBCO Silver Fabric ActiveMatrix BusinessWorks Distribution version 5.9.2, update to a version later than 5.9.2. For TIBCO BusinessWorks Engine in ActiveMatrix BusinessWorks versions prior to 5.9.3, update to version 5.9.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-0687

Affected Products

Tibco Activematrix Platform

Tibco Activematrix Runtime Platform

Tibco Businessevents Runtime

Tibco Businessworks Engine

Tibco Activematrix Businessworks Distribution For Tibco Silver Fabric

Tibco Silver Fabric Activematrix Service Grid Distribution

References · 6

• http://tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp · Vendor Advisory
• http://tibco.com/multimedia/businessevents_advisory_20120308_tcm8-15729.txt · Vendor Advisory
• http://tibco.com/multimedia/businessworks_advisory_20120308_tcm8-15730.txt · Vendor Advisory
• http://tibco.com/multimedia/activematrix2_advisory_20120308_tcm8-15726.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0687 · Security Note
• http://tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt · Vendor Advisory