Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

IBM WebSphere Application Server 7.0 < Fix Pack 5 Multiple Vulnerabilities

High

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities.

- Invoking an MBean that does not have type key-property results in a NullPointerException. (PK78743)

- Deployment fails to properly handle password in webservices client modules. (PK79275)

- IBM-portlet-ext.xmi is not reading correctly the portlet serving enable parameter. (PK89385)

- An attacker may be able to obtain sensitive information, caused by an error during the migration from WebSphere Application Server 6.1 to 7.0 when tracing is enabled. (PK80337)

- Deploying new applications on WebSphere Application Server for z/OS prior to 1.8 can result in the application being saved on the file system with insecure permissions. (PK83308)

- A security-bypass vulnerability due to a design error in the Single Sign-on with SPENEGO implementation. When setting the custom property 'ws.webcontainer.invokefilterscompatibility' to true, an attacker can bypass the SSO authentication on security URLs. (PK77465)

A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security is configured with Identity Assertion. (PK83097)

Solution

Apply Fix Pack 5 (7.0.0.5) or later.