PT-2018-4392 · Ibm · Ibm Rational Clearcase

Published 2018-03-26 · Updated 2018-04-24 · CVE-2015-5039

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational ClearCase versions 7.1.x, 8.0.0.x through 8.0.0.17, 8.0.1.x through 8.0.1.10

Description The issue concerns the Remote Client and change management integrations, which do not properly validate hostnames in X.509 certificates from SSL servers. This allows remote attackers to spoof servers, obtain sensitive information, or modify network traffic via a crafted certificate.

Recommendations For IBM Rational ClearCase versions 7.1.x, update to a version that properly validates hostnames in X.509 certificates. For IBM Rational ClearCase versions 8.0.0.x through 8.0.0.17, update to version 8.0.0.18 or later. For IBM Rational ClearCase versions 8.0.1.x through 8.0.1.10, update to version 8.0.1.11 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-5039

Affected Products

Ibm Rational Clearcase

References · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/106715 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21976566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5039 · Security Note