PT-2014-2646 · Ibm · Ibm Sametime

Published 2014-05-26 · Updated 2017-08-29 · CVE-2013-3046

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.x through 8.5.2.1 IBM Sametime versions 9.x through 9.0.0.1

Description The issue concerns the Meeting Server in IBM Sametime, which fails to send the HSTS Strict-Transport-Security header. This omission makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests.

Recommendations For IBM Sametime versions 8.x through 8.5.2.1, update to a version that includes the fix for this issue. For IBM Sametime versions 9.x through 9.0.0.1, update to a version that includes the fix for this issue. As a temporary workaround, consider configuring the server to send the HSTS Strict-Transport-Security header to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-3046

Affected Products

Ibm Sametime

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-3046 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21671201 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84819 · Note