IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations.

The remote host appears to be running IBM WebSphere Application Server 8.5 prior to 8.5.5.6.  Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as deployment descriptor security constraints are combined with ServletSecurity annotations on a servlet. This may allow a remote attacker to gain elevated privileges. (CVE-2014-8890)
 - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the IBM Global Security Kit (GSKit) due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits.  A man-in-the-middle (MitM) attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0138)
 - An information disclosure vulnerability exists due to a flaw in the Bleichenbacher countermeasure implementation in Apache WSS4J.  A remote attacker can exploit this, via a crafted message, to determine where an encryption failure took place, allowing the attacker to gain access to the plaintext symmetric key. (CVE-2015-0226)
 - An XML External Entity (XXE) vulnerability exists due to an incorrectly configured XML parser that accepts XML external entities from an untrusted source.  A remote attacker can exploit this, via specially crafted XML data, to gain access to arbitrary files. (CVE-2015-0250)
 - A privilege escalation vulnerability exists due to a flaw that occurs in 'full' profile and 'liberty' profile when using an OAuth grant password.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1885)
 - A privilege escalation vulnerability exists due to incorrect settings in the 'serveServletsbyClassname' functionality.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1927)
 - An information disclosure vulnerability exists that allows an unauthenticated, remote attacker to identify the proxy server software by reading the HTTP 'Via' header. (CVE-2015-1932)
 - An unspecified flaw exists in the administrative console that allows a remote attacker, via the 'JSESSIONID' parameter, to hijack a user's session. (CVE-2015-1936)
 - A privilege escalation vulnerability exists due to an unspecified flaw that occurs when handling user roles.  A local attacker can exploit this to gain elevated privileges. (CVE-2015-1946)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A MitM attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof servlets or disclose sensitive information. (CVE-2015-4938)

The remote host appears to be running IBM WebSphere Application Server 8.0 prior to 8.0.0.11.  Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as deployment descriptor security constraints are combined with ServletSecurity annotations on a servlet. This may allow a remote attacker to gain elevated privileges. (CVE-2014-8890)
 - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the IBM Global Security Kit (GSKit) due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits.  A man-in-the-middle (MitM) attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0138)
 - An information disclosure vulnerability exists due to a flaw in the Bleichenbacher countermeasure implementation in Apache WSS4J.  A remote attacker can exploit this, via a crafted message, to determine where an encryption failure took place, allowing the attacker to gain access to the plaintext symmetric key. (CVE-2015-0226)
 - An XML External Entity (XXE) vulnerability exists due to an incorrectly configured XML parser that accepts XML external entities from an untrusted source.  A remote attacker can exploit this, via specially crafted XML data, to gain access to arbitrary files. (CVE-2015-0250)
 - A privilege escalation vulnerability exists due to a flaw that occurs in 'full' profile and 'liberty' profile when using an OAuth grant password.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1885)
 - A privilege escalation vulnerability exists due to incorrect settings in the 'serveServletsbyClassname' functionality.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1927)
 - An information disclosure vulnerability exists that allows an unauthenticated, remote attacker to identify the proxy server software by reading the HTTP 'Via' header. (CVE-2015-1932)
 - An unspecified flaw exists in the administrative console that allows a remote attacker, via the 'JSESSIONID' parameter, to hijack a user's session. (CVE-2015-1936)
 - A privilege escalation vulnerability exists due to an unspecified flaw that occurs when handling user roles.  A local attacker can exploit this to gain elevated privileges. (CVE-2015-1946)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A MitM attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof servlets or disclose sensitive information. (CVE-2015-4938)

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.39. Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as deployment descriptor security constraints are combined with 'ServletSecurity' annotations on a servlet. This may allow a remote attacker to gain elevated privileges. (CVE-2014-8890)
 - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the IBM Global Security Kit (GSKit) due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits.  A man-in-the-middle (MitM) attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0138)
 - An information disclosure vulnerability exists due to a flaw in the Bleichenbacher countermeasure implementation in Apache WSS4J.  A remote attacker can exploit this, via a crafted message, to determine where an encryption failure took place, allowing the attacker to gain access to the plaintext symmetric key. (CVE-2015-0226)
 - An XML External Entity (XXE) vulnerability exists due to an incorrectly configured XML parser that accepts XML external entities from an untrusted source.  A remote attacker can exploit this, via specially crafted XML data, to gain access to arbitrary files. (CVE-2015-0250)
 - A privilege escalation vulnerability exists due to a flaw that occurs in 'full' profile and 'liberty' profile when using an OAuth grant password.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1885)
 - A privilege escalation vulnerability exists due to incorrect settings in the 'serveServletsbyClassname' functionality.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1927)
 - An information disclosure vulnerability exists that allows an unauthenticated, remote attacker to identify the proxy server software by reading the HTTP 'Via' header. (CVE-2015-1932)
 - An unspecified flaw exists in the administrative console that allows a remote attacker, via the 'JSESSIONID' parameter, to hijack a user's session. (CVE-2015-1936)
 - A privilege escalation vulnerability exists due to an unspecified flaw that occurs when handling user roles.  A local attacker can exploit this to gain elevated privileges. (CVE-2015-1946)
 - A flaw exists that is triggered as CRLF (Carriage Return and Line Feed) character sequences are not properly sanitized before being included in HTTP responses.  This allows a remote attacker to inject additional headers into responses to conduct HTTP response splitting attacks. (CVE-2015-2017)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A MitM attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof servlets or disclose sensitive information. (CVE-2015-4938)
 - An unspecified exists flaw in the 'Management' port. This may allow a remote attacker to execute arbitrary code. No further details have been provided by the vendor. (CVE-2015-1920)

The IBM WebSphere Application Server running on the remote host is version 8.5 prior to Fix Pack 8.5.5.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple errors exist related to the included IBM HTTP     server that can allow remote code execution or denial     of service. (CVE-2013-5704, CVE-2014-0118,     CVE-2014-0226, CVE-2014-0231 / PI22070)

  - An unspecified error exists related to HTTP headers     that can allow information disclosure. (CVE-2014-3021     / PI08268)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566 /     PI28435, PI28436, PI28437)

  - An unspecified input validation errors exist related to     the administrative console that can allow cross-site     scripting and cross-site request forgery attacks.
    (CVE-2014-4770, CVE-2014-4816 / PI23055)

  - An unspecified error exists that can allow OpenID and     OpenID Connect cookies to be spoofed, allowing     information disclosure. (CVE-2014-6164 / PI23430)

  - An error exists related to the Communications Enabled     Applications (CEA) service that can allow XML External     Entity Injection (XXE) attacks leading to information     disclosure. This only occurs if CEA is enabled. By     default this is disabled. (CVE-2014-6166 / PI25310)

  - An input validation error exists related to session     input using URL rewriting that can allow cross-site     scripting attacks. (CVE-2014-6167 / PI23819)

  - An error exists related to the administrative console     that can allow 'click-jacking' attacks. (CVE-2014-6174 /     PI27152)

  - An error exists related to deployment descriptor     security constraints and ServletSecurity annotations on     a servlet that can allow privilege escalation. Note that     this issue only affects the 'Liberty Profile'.
    (CVE-2014-8890 / PI29911)

ID	Name	Product	Family	Severity
9716	IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)	Nessus Network Monitor	Web Servers	high
9713	IBM WebSphere Application Server 8.0 < 8.0.0.11 Multiple Vulnerabilities (FREAK)	Nessus Network Monitor	Web Servers	high
9700	IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)	Nessus Network Monitor	Web Servers	high
80398	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.4 Multiple Vulnerabilities (POODLE)	Nessus	Web Servers	medium

Detections

Analytics

CVE-2014-8890

critical

Tenable Plugins

high

high

high

medium