IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.33.  Such versions are potentially affected by multiple vulnerabilities :

 - A cross-site scripting (XSS) flaw exists within the Administration Console, where user input is improperly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6323, PI04777, PI04880)
 - A denial of service flaw exists within the Global Security Kit when handling SSLv2 resumption during the SSL/TLS handshake.  This could allow a remote attacker to crash the program. (CVE-2013-6329, PI05309)
 - A buffer overflow flaw exists in the HTTP server with the 'mod_dav' module when using add-ons.  This could allow a remote attacker to cause a buffer overflow and a denial of service. (CVE-2013-6438, PI09345)
 - An XSS flaw exists within 'OAuth' where user input is not properly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6738, PI05661)
 - A denial of service (DoS) flaw exists within the Global Security Kit when handling the X.509 certificate chain during the initiation of an SSL/TLS connection.  A remote attacker, using a malformed certificate chain, could cause the client or server to crash by hanging the Global Security Kit. (CVE-2013-6747, PI09443)
 - A DoS flaw exists within the Apache Commons 'FileUpload' when parsing a content-type header for a multipart request.  A remote attacker, using a specially crafted request, could crash the program. (CVE-2014-0050, PI12648, PI12926 and PI13162)
 - A DoS flaw exists in the 'mod_log_config' when logging a cookie with an unassigned value.  A remote attacker, using a specially crafted request, can cause the program to crash. (CVE-2014-0098, PI13028)
 - A remote code execution flaw exists with Apache Struts.  The failure to restrict setting of class loader attributes could allow a remote attacker to execute arbitrary script code. (CVE-2014-0114, PI17190)
 - An information disclosure flaw exists in the 'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.  This many allow a remote attacker to gain timing information intended to be protected by encryption. (CVE-2014-0453)
 - A flaw exists within 'com.sun.jndi.dns.DnsClient' related to the randomization of query IDs. This could  allow a remote attacker to conduct spoofing attacks. (CVE-2014-0460)
 - A DoS flaw exists in a web server plugin on servers configured to retry failed POST requests.  This could allow a remote attacker to crash the application. (CVE-2014-0859, PI08892)
 - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom' cryptographic providers by generating numbers in a predictable manner.  This could allow a remote attacker to easily guess the output of the random number generator. (CVE-2014-0878)
 - An information disclosure flaw exists within Proxy and ODR servers.  This could allow a remote attacker, using a specially crafted request, to gain access to potentially sensitive information. (CVE-2014-0891, PI09786)
 - A DoS flaw exists within the IBM Security Access Manager for Web with the Reverse Proxy component.  This could allow a remote attacker, using specially crafted TLS traffic, to cause the application on the system to become unresponsive. (CVE-2014-0963, PI17025)
 - An information disclosure flaw exists when handling SOAP responses.  This could allow a remote attacker to potentially gain access to sensitive information. (CVE-2014-0965, PI11434)
 - An information disclosure flaw exists.  A remote attacker, using a specially crafted URL, could gain access to potentially sensitive information. (CVE-2014-3022, PI09594)
 - An unspecified flaw exists that may allow an attacker to gain elevated privileges.  No further details have been provided.

The remote host appears to be running IBM WebSphere Application Server 8.5 prior to Fix Pack 8.5.5.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the Elliptic Curve Digital Signature     Algorithm implementation which could allow a malicious     process to recover ECDSA nonces.
    (CVE-2014-0076, PI19700)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

  - A flaw exists within the 'addFileRegistryAccount'     Virtual Member Manager SPI Admin Task, which creates     improper accounts. This could allow a remote attacker     to bypass security checks. (CVE-2014-3070, PI16765)

  - An unspecified information disclosure flaw exists. This     could allow a remote attacker access to gain sensitive     information. (CVE-2014-3083, PI17768)

  - An information disclosure flaw exists within the     'share/classes/sun/security/rsa/RSACore.java' class     related to 'RSA blinding' caused during operations using     private keys and measuring timing differences. This     could allow a remote attacker to gain information about     used keys. (CVE-2014-4244)

  - A flaw exists within the 'validateDHPublicKey' function     in the 'share/classes/sun/security/util/KeyUtil.java'     class which is triggered during the validation of     Diffie-Hellman public key parameters. This could allow a     remote attacker to recover a key. (CVE-2014-4263)

  - A flaw exists within the Load Balancer for IPv4     Dispatcher component. This could allow a remote attacker     to crash the Load Balancer. (CVE-2014-4764, PI21189)

  - A flaw exists within the Liberty Repository when     installing features. This could allow an authenticated     remote attacker to install and execute arbitrary code.
    (CVE-2014-4767, PI21284)

IBM WebSphere Application Server 8.0 prior to Fix Pack 9 is running on the remote host. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting flaw exists within the     Administration Console, where user input is improperly     validated. This could allow a remote attacker, with a     specially crafted request, to execute arbitrary script     code within the browser / server trust relationship.
    (CVE-2013-6323, PI04777 and PI04880)

  - A denial of service flaw exists within the Global     Security Kit when handling SSLv2 resumption during the     SSL/TLS handshake. This could allow a remote attacker     to crash the program. (CVE-2013-6329, PI05309)

  - A buffer overflow flaw exists in the HTTP server with     the mod_dav module when using add-ons. This could allow     a remote attacker to cause a buffer overflow and a     denial of service. (CVE-2013-6438, PI09345)

  - A cross-site scripting flaw exists within OAuth where     user input is not properly validated. This could allow     a remote attacker, with a specially crafted request, to     execute arbitrary script code within the browser /     server trust relationship. (CVE-2013-6738, PI05661)

  - A denial of service flaw exists within the Global     Security Kit when handling X.509 certificate chain     during the initiation of a SSL/TLS connection. A remote     attacker, using a malformed certificate chain, could     cause the client or server to crash by hanging the     Global Security Kit. (CVE-2013-6747, PI09443)

  - A denial of service flaw exists within the Apache     Commons FileUpload when parsing a content-type header     for a multipart request. A remote attacker, using a     specially crafted request, could crash the program.
    (CVE-2014-0050, PI12648, PI12926 and PI13162)

  - A flaw exists in the Elliptic Curve Digital Signature     Algorithm implementation which could allow a malicious     process to recover ECDSA nonces.
    (CVE-2014-0076, PI19700)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - An information disclosure flaw exists in the     'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.
    This many allow a remote attacker to gain timing     information intended to be protected by encryption.
    (CVE-2014-0453)

  - A flaw exists with 'com.sun.jndi.dns.DnsClient' related     to the randomization of query IDs. This could allow a     remote attacker to conduct spoofing attacks.
    (CVE-2014-0460)

  - A flaw exists in the Full and Liberty profiles. A remote     attacker, using a specially crafted request, could gain     access to arbitrary files. (CVE-2014-0823, PI05324)

  - An information disclosure flaw exists within the     Administrative Console. This could allow a network     attacker, using a specially crafted request, to gain     privileged access. (CVE-2014-0857, PI07808)

  - A denial of service flaw exists in a web server plugin     on servers configured to retry failed POST request. This     could allow a remote attacker to crash the application.
    (CVE-2014-0859, PI08892)

  - An information disclosure flaw exists within Proxy and     ODR servers. This could allow a remote attacker, using a     specially crafted request, to gain access to potentially     sensitive information. (CVE-2014-0891, PI09786)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

IBM WebSphere Application Server 7.0 prior to Fix Pack 33 is running on the remote host. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting flaw exists within the     Administration Console, where user input is improperly     validated. This could allow a remote attacker, with a     specially crafted request, to execute arbitrary script     code within the browser / server trust relationship.
    (CVE-2013-6323, PI04777 and PI04880)

  - A denial of service flaw exists within the Global     Security Kit when handling SSLv2 resumption during the     SSL/TLS handshake. This could allow a remote attacker     to crash the program. (CVE-2013-6329, PI05309)

  - A buffer overflow flaw exists in the HTTP server with     the mod_dav module when using add-ons. This could allow     a remote attacker to cause a buffer overflow and a     denial of service. (CVE-2013-6438, PI09345)

  - A cross-site scripting flaw exists within OAuth where     user input is not properly validated. This could allow     a remote attacker, with a specially crafted request, to     execute arbitrary script code within the browser /     server trust relationship. (CVE-2013-6738, PI05661)

  - A denial of service flaw exists within the Global     Security Kit when handling X.509 certificate chain     during the initiation of an SSL/TLS connection. A remote     attacker, using a malformed certificate chain, could     cause the client or server to crash by hanging the     Global Security Kit. (CVE-2013-6747, PI09443)

  - A denial of service flaw exists within the Apache     Commons FileUpload when parsing a content-type header     for a multipart request. A remote attacker, using a     specially crafted request, could crash the program.
    (CVE-2014-0050, PI12648, PI12926 and PI13162)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - A remote code execution flaw exists with Apache Struts.
    The failure to restrict setting of Class loader     attributes could allow a remote attacker to     execute arbitrary script code. (CVE-2014-0114, PI17190)

  - An information disclosure flaw exists in the     'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.
    This many allow a remote attacker to gain timing     information intended to be protected by encryption.
    (CVE-2014-0453)

  - A flaw exists within 'com.sun.jndi.dns.DnsClient'     related to the randomization of query IDs. This could     allow a remote attacker to conduct spoofing attacks.
    (CVE-2014-0460)

  - A denial of service flaw exists in a web server plugin     on servers configured to retry failed POST request. This     could allow a remote attacker to crash the application.
    (CVE-2014-0859, PI08892)

  - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom'     cryptographic providers by generating numbers in a     predictable manner. This could allow a remote attacker     to easily guess the output of the random number     generator. (CVE-2014-0878)

  - An information disclosure flaw exists within Proxy and     ODR servers. This could allow a remote attacker, using a     specially crafted request, to gain access to potentially     sensitive information. (CVE-2014-0891, PI09786)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

ID	Name	Product	Family	Severity
9699	IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
77438	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.3 Multiple Vulnerabilities	Nessus	Web Servers	medium
76995	IBM WebSphere Application Server 8.0 < Fix Pack 9 Multiple Vulnerabilities	Nessus	Web Servers	high
76967	IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2014-3022

high

Tenable Plugins

critical

medium

high

high