PT-2013-1934 · Ibm · Ibm Tivoli Federated Identity Manager+1

Published 2013-01-18 · Updated 2017-08-29 · CVE-2012-6359

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.0 through 6.2.0.10 IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.1 through 6.2.1.2 IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.2 through 6.2.2.1 Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.0 through 6.2.0.10 Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.1 through 6.2.1.2 Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.2 through 6.2.2.1

Description The issue arises from the failure to verify the signature of OpenID attributes in the SREG (simple registration extension) and AX (attribute exchange extension) cases. This oversight allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.

Recommendations For IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.0 through 6.2.0.10, update to version 6.2.0.11 or later. For IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.1 through 6.2.1.2, update to version 6.2.1.3 or later. For IBM Tivoli Federated Identity Manager (TFIM) versions 6.2.2 through 6.2.2.1, update to version 6.2.2.2 or later. For Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.0 through 6.2.0.10, update to version 6.2.0.11 or later. For Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.1 through 6.2.1.2, update to version 6.2.1.3 or later. For Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.2.2 through 6.2.2.1, update to version 6.2.2.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-6359

Affected Products

Ibm Tivoli Federated Identity Manager

Ibm Tivoli Federated Identity Manager Business Gateway

References · 9

• http://www-01.ibm.com/support/docview.wss?uid=swg21615748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6359 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21615744 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV23453 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV23451 · Vendor Advisory
• http://securityfocus.com/bid/56390 · Note
• http://secunia.com/advisories/51212 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77790 · Note