IBM WebSphere Application Server WSPolicy information disclosure
| websphere-wspolicy-information-disclosure (48700) |  Low Risk |
Description:
WebSphere Application Server could potentially allow a local attacker to obtain sensitive information. When using Web Services and the client is using a WSPolicy of ProviderOnly (server policy is used to configure the client) and using a simple UserNameToken policyset with the binding property com.ibm.wsspi.wssecurity.token/IDAssertion.isUsed set to true, WSPolicy might ignore this and put sensitive information into the SOAP message. This could allow the client to access information that was not intended to be sent.IBM3
*CVSS:
| Base Score: | 1 |
| Access Vector: | Local |
| Access Complexity: | High |
| Authentication: | Single |
| Confidentiality Impact: | Partial |
| Integrity Impact: | None |
| Availability Impact: | None |
| Temporal Score: | .7 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Obtain Information
Remedy:
Apply the latest Fix Pack (7.0.0.1 or later) or APAR PK73573. See References.
——OR——
As a workaround, add the "NoPassword" property to the token generator element in the bindings.
References:
- IBM Support & downloads: Fix list for IBM WebSphere Application Server version 7.0.
- BID-33879: IBM WebSphere Application Server WSPolicy Information Disclosure Vulnerability
- CVE-2009-0504: WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.
Platforms Affected:
- IBM WebSphere Application Server 7.0
Reported:
Feb 12, 2009
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.