PT-2013-1593 · Ibm · Ibm Tivoli Federated Identity Manager

Published 2013-01-17 · Updated 2017-08-29 · CVE-2012-3310

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager (TFIM) versions prior to 6.1.1.14 IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.0 through 6.2.0.11 IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.1 through 6.2.1.3

Description The issue allows context-dependent attackers to discover sensitive information, including cleartext passwords, by leveraging a logging configuration with a log trace setting of all. This can lead to the exposure of a cleartext LDAP Bind Password, keystore passwords, a cleartext Basic Authentication password from a client, or a cleartext user password.

Recommendations For versions prior to 6.1.1.14, update to version 6.1.1.14 or later. For versions 6.2.0 through 6.2.0.11, update to version 6.2.0.12 or later. For versions 6.2.1 through 6.2.1.3, update to version 6.2.1.4 or later.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-3310

Affected Products

Ibm Tivoli Federated Identity Manager

References · 6

• http://ibm.com/support/docview.wss?uid=swg21615977 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV26823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3310 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV26824 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV26822 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77695 · Note