PT-2016-1413 · Ibm · Ibm Infosphere Information Server

Published 2016-03-03 · Updated 2017-09-08 · CVE-2015-7490

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 8.5 through FP3 IBM InfoSphere Information Server versions 8.7 through FP2 IBM InfoSphere Information Server versions 9.1 through 9.1.2.0 IBM InfoSphere Information Server versions 11.3 through 11.3.1.2 IBM InfoSphere Information Server versions 11.5

Description The issue is related to insufficient access control in the InfoSphere Information Server platform. It allows a remote authenticated user to bypass intended access restrictions by using a modified cookie.

Recommendations For IBM InfoSphere Information Server versions 8.5 through FP3, update to a version later than FP3 to resolve the issue. For IBM InfoSphere Information Server versions 8.7 through FP2, update to a version later than FP2 to resolve the issue. For IBM InfoSphere Information Server versions 9.1 through 9.1.2.0, update to a version later than 9.1.2.0 to resolve the issue. For IBM InfoSphere Information Server versions 11.3 through 11.3.1.2, update to a version later than 11.3.1.2 to resolve the issue. For IBM InfoSphere Information Server versions 11.5, update to a version later than 11.5 to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-00714

CVE-2015-7490

Affected Products

Ibm Infosphere Information Server

References · 5

• https://bdu.fstec.ru/vul/2016-00714 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR54787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7490 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21975827 · Vendor Advisory
• http://securitytracker.com/id/1035125 · Note