PT-2012-2833 · Ibm · Ibm Tivoli Event Pump

Published 2012-04-09 · Updated 2017-08-29 · CVE-2012-0742

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Event Pump version 4.2.2

Description The issue allows local users to obtain sensitive information by reading the AOPSCLOG (aka AOPLOG) data set. This occurs when the LOG REQUESTS and VALIDATE SOAP USERS options are enabled, causing credentials to be placed into the AOPSCLOG data set.

Recommendations For IBM Tivoli Event Pump version 4.2.2, consider disabling the LOG REQUESTS and VALIDATE SOAP USERS options as a temporary workaround to prevent credentials from being logged to the AOPSCLOG data set. Restrict access to the AOPSCLOG data set to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-0742

Affected Products

Ibm Tivoli Event Pump

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-0742 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1OA38586 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74641 · Note