IBM Websphere Application Server Default Messaging Component security bypass
| websphere-messaging-security-bypass (34901) |  Medium Risk |
Description:
IBM Websphere Application Server could allow a remote attacker to bypass security restrictions, caused by improper authorization on a remote interface to the SDO repository by the Default Messaging Component. A remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable system.
Platforms Affected:
- IBM, i5/OS
- IBM, WebSphere Application Server 6.1.0.7 and prior
Remedy:
Upgrade to the latest version of IBM WebSphere Application Server (Fix Pack 9 (6.1.0.9) or later), available from the IBM Support & downloads Web site. See References.
Consequences:
Bypass Security
References:
- IBM Support Web site, Fix list for IBM WebSphere Application Server version 6.1 at http://www-1.ibm.com/support/docview.wss?uid=swg27007951.
- BID-24505: IBM WebSphere Application Server Unspecified Vulnerabilities
- CVE-2007-3263: Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors, related to incorrect authorization on a remote interface to the SDO repository.
- FrSIRT/ADV-2007-2234: IBM WebSphere Application Server Security Bypass and Information Disclosure Issues
- SA25704: IBM WebSphere Application Server Multiple Vulnerabilities
Reported:
Jun 15, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net