The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement security constraints on the (1) doGet and (2) doTrace methods, which allows remote attackers to bypass intended access restrictions and obtain sensitive information via a crafted HTTP HEAD request to a Web Application.

IBM WebSphere Application Server 7.0 before Fix Pack 7 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - A cross-site request forgery vulnerability exists due     to insufficient validation of user-supplied input by     the administrative console. (PK87176)

  - Due to an error in Java Naming and Directory Interface,     it may be possible to obtain sensitive information.
    (PK91414).

  - The administrative console is affected by a     cross-site scripting vulnerability. (PK92057)

  - It may be possible to bypass security restrictions     using a specially crafted HTTP HEAD method.     (PK83258)

IBM WebSphere Application Server 6.1.0 before Fix Pack 27 appears to be running on the remote host.  Such versions are potentially affected by multiple issues : 

  - Eclipse help system included with WebSphere Application Server is affected by a cross-site scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application Server for z/OS prior to 1.8 are saved on the file system with insecure privileges resulting in disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using wsadmin scripts, the password value may appear in FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service issue. (PK88341)

  - Due to an error in expat XML parser APR-util is affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service attack due to errors in fix packs 6.1.0.23 and 6.1.0.25. (PK91709)

IBM WebSphere Application Server 6.1 before Fix Pack 27 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - The Eclipse help system included with WebSphere     Application Server is affected by a cross-site     scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions     using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using     wsadmin scripts, the password value may appear in     FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service     issue. (PK88341)

  - Due to an error in expat XML parser, APR-util is     affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service     attack due to errors in Fix Packs 6.1.0.23 and     6.1.0.25. (PK91709)

ID	Name	Product	Family	Severity
42821	IBM WebSphere Application Server 7.0 < Fix Pack 7	Nessus	Web Servers	medium
5183	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
41057	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2009-3106

high

Tenable Plugins

medium

medium

medium