The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - If the admin console is directly accessed from HTTP,     the console fails to redirect the connection to a     secure login page. (PK77010)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure.     (PK77495)  

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - After upgrading from WebSphere Application Server V6.1     to V7.0 with tracing enabled, an attacker may be able     view sensitive information by viewing the trace files.
    (PK80337)  

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - Vulnerabilities in Apache HTTP server could allow a     local user to gain elevated privileges. (PK86232)

  - A error in 'wsadmin' could allow a remote attacker     to bypass security restrictions. (PK86328)    
  - A vulnerability in portlet serving enable parameter     could allow an attacker to bypass security restrictions     and gain unauthorized access to the application.     (PK89385)

IBM WebSphere Application Server 6.1 before Fix Pack 25 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure. (PK77495)

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - In certain cases sensitive information may appear in     migration trace. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - Sensitive information might appear in trace files.
    (PK80337)

  - XML digital signature is affected by a security issue.
    (PK80596)

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - IBM Stax XMLStreamWriter may write to an incorrect XML     file, and hence is susceptible to a XML fuzzing attack.
    (PK84015)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

IBM WebSphere Application Server 6.0.2 before Fix Pack 35 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - A login using the LPTAToken cookie may result in     extending LTPAToken expiration time longer than the     LTPAToken timeout value. (PK75919)

  - Cross-site scripting vulnerabilities exist in sample     applications. (PK76720)

  - If the admin console is directly accessed from http,     the console fails to redirect the connection to a     secure login page. (PK77010)

  - 'wsadmin' is affected by a security exposure.     (PK77495)

  - XML digital signature is affected by a security issue.
    (PK80596) 

  - In certain cases, application source files are exposed.     (PK81387)

  - Configservice APIs could display sensitive information.     (PK84999)

IBM WebSphere Application Server 6.1.0 before Fix Pack 25 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities : 

  - The administrative component's secure login page fails to redirect to an 'https: //' page when it receives an 'http: //' request. (PK77010)

  - An unspecified security issue affects 'wsadmin' in the 'SystemManagement/Repository' component. (PK77235)

  - An information disclosure vulnerability affects the 'Configservice APIs' in the Administrative Console' component. (PK84999)

  - An unspecified vulnerability affects the 'Security' component, which permits 'non-standard HTTP methods'. (PK773246)

  - A security-bypass vulnerability when users use JAX-WS applications with a WS-Security policy set at the operational level. (PK87767)

  - A denial-of-service vulnerability caused because the application uses insecure obfuscation in web services. (PK79275)

  - An information disclosure vulnerability affecting the Migration component when WAS is migrated from version 6.1 to 7.0 and tracing is enabled. (PK80337)

  - A security-bypass issue caused by an error in the Single Sign-on with SPNEGO implementation. (PK77465)

  - A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security with Identity Assertion. (PK83097)

IBM WebSphere Application Server 6.0.2 before Fix Pack 35 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities : 

  - The administrative component's secure login page fails to redirect to an 'https: //' page when it receives an 'http: //' request. (PK77010)

  - An unspecified security issue affects 'wsadmin' in the 'SystemManagement/Repository' component. (PK77235)

  - An information disclosure vulnerability affects the 'Configservice APIs' in the Administrative Console' component. (PK84999)

  - An unspecified vulnerability affects the 'Security' component, which permits 'non-standard HTTP methods'. (PK773246)

ID	Name	Product	Family	Severity
40823	IBM WebSphere Application Server 7.0 < Fix Pack 5	Nessus	Web Servers	medium
39450	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus	Web Servers	medium
38978	IBM WebSphere Application Server < 6.0.2.35 Multiple Vulnerabilities	Nessus	Web Servers	medium
5077	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
5076	IBM WebSphere Application Server < 6.0.2.35 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2009-1900

high

Tenable Plugins

medium

medium

medium

high

medium