PT-2013-2406 · Ibm · Ibm Sterling Connect:Direct

Published 2013-06-21 · Updated 2017-08-29 · CVE-2013-0529

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect:Direct versions 1.4 through 1.4.0.10 IBM Sterling Connect:Direct versions 1.5 through 1.5.0.1

Description The issue concerns the Browser component in IBM Sterling Connect:Direct, where it fails to set the secure flag for the session cookie during an https session. This oversight makes it easier for remote attackers to capture the cookie by intercepting its transmission within an http session.

Recommendations For IBM Sterling Connect:Direct versions 1.4 through 1.4.0.10, update to version 1.4.0.11 or later. For IBM Sterling Connect:Direct versions 1.5 through 1.5.0.1, update to a version later than 1.5.0.1.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-0529

Affected Products

Ibm Sterling Connect:Direct

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-0529 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC90478 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21640356 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82611 · Note