IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)

high Nessus Network Monitor Plugin ID 9716
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote host is running an application server that is vulnerable to multiple attack vectors.

Description

The remote host appears to be running IBM WebSphere Application Server 8.5 prior to 8.5.5.6. Such versions are potentially affected by multiple issues :

- A flaw exists that is triggered as deployment descriptor security constraints are combined with ServletSecurity annotations on a servlet. This may allow a remote attacker to gain elevated privileges. (CVE-2014-8890)
- A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the IBM Global Security Kit (GSKit) due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle (MitM) attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0138)
- An information disclosure vulnerability exists due to a flaw in the Bleichenbacher countermeasure implementation in Apache WSS4J. A remote attacker can exploit this, via a crafted message, to determine where an encryption failure took place, allowing the attacker to gain access to the plaintext symmetric key. (CVE-2015-0226)
- An XML External Entity (XXE) vulnerability exists due to an incorrectly configured XML parser that accepts XML external entities from an untrusted source. A remote attacker can exploit this, via specially crafted XML data, to gain access to arbitrary files. (CVE-2015-0250)
- A privilege escalation vulnerability exists due to a flaw that occurs in 'full' profile and 'liberty' profile when using an OAuth grant password. A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1885)
- A privilege escalation vulnerability exists due to incorrect settings in the 'serveServletsbyClassname' functionality. A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1927)
- An information disclosure vulnerability exists that allows an unauthenticated, remote attacker to identify the proxy server software by reading the HTTP 'Via' header. (CVE-2015-1932)
- An unspecified flaw exists in the administrative console that allows a remote attacker, via the 'JSESSIONID' parameter, to hijack a user's session. (CVE-2015-1936)
- A privilege escalation vulnerability exists due to an unspecified flaw that occurs when handling user roles. A local attacker can exploit this to gain elevated privileges. (CVE-2015-1946)
- A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A MitM attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
- An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof servlets or disclose sensitive information. (CVE-2015-4938)

Solution

Upgrade WebSphere Application Server to 8.5.5.6 or later.

See Also

http://www-01.ibm.com/support/docview.wss?uid=swg27036319#8556

Plugin Details

Severity: High

ID: 9716

Family: Web Servers

Published: 10/26/2016

Updated: 3/6/2019

Dependencies: 4270

Nessus ID: 84639

Risk Information

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*

Patch Publication Date: 8/18/2015

Vulnerability Publication Date: 8/18/2015

Reference Information

CVE: CVE-2015-0138, CVE-2015-2808, CVE-2015-0226, CVE-2015-0250, CVE-2014-8890, CVE-2015-1927, CVE-2015-1936, CVE-2015-4938, CVE-2015-1946, CVE-2015-1932, CVE-2015-1885

BID: 73326, 73684, 71834, 72553, 74219, 75480, 75486, 75496, 76463, 76466