The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.

IBM WebSphere Application Server 6.1 before Fix Pack 25 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure. (PK77495)

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - In certain cases sensitive information may appear in     migration trace. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - Sensitive information might appear in trace files.
    (PK80337)

  - XML digital signature is affected by a security issue.
    (PK80596)

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - IBM Stax XMLStreamWriter may write to an incorrect XML     file, and hence is susceptible to a XML fuzzing attack.
    (PK84015)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

IBM WebSphere Application Server 6.1.0 before Fix Pack 25 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities : 

  - The administrative component's secure login page fails to redirect to an 'https: //' page when it receives an 'http: //' request. (PK77010)

  - An unspecified security issue affects 'wsadmin' in the 'SystemManagement/Repository' component. (PK77235)

  - An information disclosure vulnerability affects the 'Configservice APIs' in the Administrative Console' component. (PK84999)

  - An unspecified vulnerability affects the 'Security' component, which permits 'non-standard HTTP methods'. (PK773246)

  - A security-bypass vulnerability when users use JAX-WS applications with a WS-Security policy set at the operational level. (PK87767)

  - A denial-of-service vulnerability caused because the application uses insecure obfuscation in web services. (PK79275)

  - An information disclosure vulnerability affecting the Migration component when WAS is migrated from version 6.1 to 7.0 and tracing is enabled. (PK80337)

  - A security-bypass issue caused by an error in the Single Sign-on with SPNEGO implementation. (PK77465)

  - A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security with Identity Assertion. (PK83097)

ID	Name	Product	Family	Type	Severity
39450	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
5077	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		high

Detections

Analytics

CVE-2009-0904

high

Tenable Plugins

medium

high