IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to spoof SSL servers via vectors involving insertion of an arbitrary root Certification Authority (CA) certificate.

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 9. It is, therefore, affected by one or more of the following vulnerabilities :

  - The included software, GSKit, contains several errors     related to SSL and TLS that can result in denial of     service, information disclosures, or unauthorized     insertion of an arbitrary root Certification Authority     certificate. (CVE-2012-2190, CVE-2012-2191,     CVE-2012-2203, CVE-2013-0169 / IC90395)

  - A stack-based buffer overflow exists related to     'db2aud' and 'db2flacc' that allows a local attacker     to elevate privileges to that of an instance owner. The     'db2aud' issue does not affect installs on the Windows     operating system. (CVE-2013-3475 / IC92495)

  - An unspecified error exists that allows an attacker to     gain SELECT, INSERT, UPDATE, or DELETE permissions to     database tables. Note that successful exploitation     requires the rights EXPLAIN, SQLADM, or DBADM.
    (CVE-2013-4033 / IC94523)

  - An error exists related to the XSLT parser that allows     a NULL pointer to be dereferenced. (CVE-2013-5466 /     IC97470)

  - An error exists related to queries containing OLAP     specifications that allows remote, authenticated     attackers to close database connections and deactivate     the database. (CVE-2013-6717 / IC95641)

The version of IBM WebSphere MQ server is version 7.1 without Fix Pack 7.1.0.2 or 7.5 without Fix Pack 7.5.0.1. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in Global Security Kit (GSkit) due to a     failure to properly validate data when the 'protection     mechanism' is executed against an SSL CBC timing attack.
    A remote attacker, using crafted values in the TLS Record     Layer, can exploit this to cause a denial of service.
    (CVE-2012-2191)

  - A flaw exists in Global Security Kit (GSkit) due to a     failure to properly verify certificates, which can allow     a remote attacker to conduct a man-in-the-middle attack.
    (CVE-2012-2203)

  - An application can potentially put a sequence of large     messages into the queue, causing a buffer to overflow in     the queue manager. This can lead to a denial of service.
    (CVE-2012-4863)

The version of IBM WebSphere MQ server is version 7.0 without Fix Pack 7.0.1.9, 7.1 without Fix Pack 7.1.0.2 or 7.5 without Fix Pack 7.5.0.1. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in Global Security Kit (GSkit) due to a     failure to properly validate data when the 'protection     mechanism' is executed against an SSL CBC timing attack.
    A remote attacker, using crafted values in the TLS Record     Layer, can exploit this to cause a denial of service.
    (CVE-2012-2191)

  - A flaw exists in Global Security Kit (GSkit) due to a     failure to properly verify certificates, which can allow     a remote attacker to conduct a man-in-the-middle attack.
    (CVE-2012-2203)

The remote host has a version of IBM Rational ClearQuest 7.1.x prior to 7.1.2.8 / 8.0.0.x prior to 8.0.0.4 installed. It is, therefore, affected by a spoofing vulnerability related to the included Global Security Kit (GSKit) and certificate objects.

The GSKit does not enforce file integrity of the PKCS #12 files it uses and is vulnerable to SSL server spoofing because the insertion of arbitrary CA certificates is possible.

Note that deployments not using LDAP are not affected and that PKCS #12 is not the default format used by ClearQuest.

ID	Name	Product	Family	Type	Severity
71519	IBM DB2 9.7 < Fix Pack 9 Multiple Vulnerabilities	Nessus	Databases	Remote	critical
63099	IBM WebSphere MQ 7.1 / 7.5 Multiple Vulnerabilities	Nessus	Windows	Local	high
63098	IBM WebSphere MQ 7.0 / 7.1 / 7.5 Global Security Toolkit Vulnerabilities	Nessus	Windows	Local	high
62786	IBM Rational ClearQuest 7.1.x < 7.1.2.8 / 8.0.0.x < 8.0.0.4 GSKit Spoofing (credentialed check)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2012-2203

medium

Tenable Plugins

critical

high

high

high