PT-2012-6088 · Ibm · Ibm Websphere Datapower Xc10 Appliance

Published 2012-11-23 · Updated 2017-08-29 · CVE-2012-5758

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 Appliance versions 2.0.0.0 through 2.0.0.3 IBM WebSphere DataPower XC10 Appliance versions 2.1.0.0 through 2.1.0.2

Description The issue allows remote attackers to cause a denial of service, resulting in a process exit, due to the lack of authentication for an unspecified interface. The exact vectors used for the attack are not specified.

Recommendations For versions 2.0.0.0 through 2.0.0.3, consider restricting access to the unspecified interface until a fix is available. For versions 2.1.0.0 through 2.1.0.2, consider implementing authentication for the interface to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-5758

Affected Products

Ibm Websphere Datapower Xc10 Appliance

References · 8

• http://www-01.ibm.com/support/docview.wss?uid=swg21615783 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC86908 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg24033740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5758 · Security Note
• http://securitytracker.com/id?1027798 · Note
• http://secunia.com/advisories/51319 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80063 · Note
• http://securityfocus.com/bid/56617 · Note