IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure Data Capture (FFDC) log file.

IBM WebSphere Application Server 6.1.0 before Fix Pack 27 appears to be running on the remote host.  Such versions are potentially affected by multiple issues : 

  - Eclipse help system included with WebSphere Application Server is affected by a cross-site scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application Server for z/OS prior to 1.8 are saved on the file system with insecure privileges resulting in disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using wsadmin scripts, the password value may appear in FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service issue. (PK88341)

  - Due to an error in expat XML parser APR-util is affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service attack due to errors in fix packs 6.1.0.23 and 6.1.0.25. (PK91709)

IBM WebSphere Application Server 6.1 before Fix Pack 27 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - The Eclipse help system included with WebSphere     Application Server is affected by a cross-site     scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions     using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using     wsadmin scripts, the password value may appear in     FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service     issue. (PK88341)

  - Due to an error in expat XML parser, APR-util is     affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service     attack due to errors in Fix Packs 6.1.0.23 and     6.1.0.25. (PK91709)

ID	Name	Product	Family	Type	Severity
5183	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		medium
41057	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium

Detections

Analytics

CVE-2009-2743

medium

Tenable Plugins

medium

medium