PT-2014-3177 · Ibm · Ibm Sametime

Published 2014-01-31 · Updated 2017-08-29 · CVE-2013-6727

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.5.2 through 8.5.2.1 IBM Sametime version 9.0 before HF1

Description The issue is related to the Connect client in IBM Sametime, which does not properly restrict unsigned Java plugins. This allows remote attackers to obtain sensitive information via unspecified vectors.

Recommendations For IBM Sametime versions 8.5.2 through 8.5.2.1, update to a version that properly restricts unsigned Java plugins. For IBM Sametime version 9.0 before HF1, apply Hotfix 1 to restrict unsigned Java plugins.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6727

Affected Products

Ibm Sametime

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21662725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6727 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89282 · Note