IBM WebSphere Application Server 7.0 < Fix Pack 5 Multiple Vulnerabilities
High Nessus Network Monitor Plugin ID 5142
SynopsisThe remote host is vulnerable to multiple attack vectors.
DescriptionIBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities.
- Invoking an MBean that does not have type key-property results in a NullPointerException. (PK78743)
- Deployment fails to properly handle password in webservices client modules. (PK79275)
- IBM-portlet-ext.xmi is not reading correctly the portlet serving enable parameter. (PK89385)
- An attacker may be able to obtain sensitive information, caused by an error during the migration from WebSphere Application Server 6.1 to 7.0 when tracing is enabled. (PK80337)
- Deploying new applications on WebSphere Application Server for z/OS prior to 1.8 can result in the application being saved on the file system with insecure permissions. (PK83308)
- A security-bypass vulnerability due to a design error in the Single Sign-on with SPENEGO implementation. When setting the custom property 'ws.webcontainer.invokefilterscompatibility' to true, an attacker can bypass the SSO authentication on security URLs. (PK77465)
A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security is configured with Identity Assertion. (PK83097)
SolutionApply Fix Pack 5 (220.127.116.11) or later.