IBM WebSphere Application Server < 6.0.2.33 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 4990

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

IBM WebSphere Application Server 6.0.2 before Fix Pack 33 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities :

- Provided an attacker has valid credentials, it may be possible to hijack an authenticated session. (PK66676)

- The PerfServlet code writes sensitive information in the 'systemout.log' and ffdc files, provided Performance Monitoring Infrastructure (PMI) is enabled. (PK63886)

- It may be possible to login to the administrative console using a user account that is locked by the operating system. (PK67909)

- An unknown vulnerability affects z/OS-based IBM WebSphere application servers. (PK71143)

- An unspecified vulnerability in the administrative console could allow arbitrary file retrieval from the remote system. (PK72036)

- If APAR PK41002 has been applied, an unspecified vulnerability in JAX-RPC WS-Security component could incorrectly validate 'UsernameToken'. (PK75992)

- Certain files associated with interim fixes for Unix-based versions of IBM WebSphere Application Server are built with insecure file permissions. (PK78960)

Solution

Apply Fix Pack 33 (6.0.2.33) or higher.

See Also

http://www-01.ibm.com/support/docview.wss?uid=swg27006876#60233

http://www-01.ibm.com/support/docview.wss?uid=swg21367223

http://www-01.ibm.com/support/docview.wss?uid=swg24022693

http://www-01.ibm.com/support/docview.wss?uid=swg1PK67909

Plugin Details

Severity: High

ID: 4990

File Name: 4990.prm

Family: Web Servers

Published: 2009/04/15

Modified: 2016/01/15

Dependencies: 4270

Nessus ID: 36132

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Reference Information

CVE: CVE-2009-0891, CVE-2009-0506

BID: 34330, 33884, 35610