PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files. NOTE: this is probably a duplicate of CVE-2008-5413.

IBM WebSphere Application Server 6.1 before Fix Pack 21 appears to be running on the remote host.  Such versions are reportedly affected by multiple flaws :

  - Provided Performance Monitoring Infrastructure (PMI) is
    enabled. It may be possible for a local attacker to
    obtain sensitive information through 'Systemout.log' and
    'ffdc' files which are written by PerfServlet.
  - SSL Configuration settings attribute 'Security Level' 
    does not correctly enforce the level of encryption used
    by the application server. (PK63182) 

IBM WebSphere Application Server 6.1 before Fix Pack 21 appears to be running on the remote host.  As such, it is reportedly affected by multiple flaws :

  - Provided Performance Monitoring Infrastructure (PMI) is     enabled, it may be possible for a local attacker to     obtain sensitive information through 'Systemout.log' and     'ffdc' files that are written by PerfServlet.

  - SSL Configuration settings attribute 'Security Level'     does not correctly enforce the level of encryption used     by the application server. (PK63182)

IBM WebSphere Application Server 7.0 before Fix Pack 1 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities.

  - A vulnerability in feature pack for web services could lead to information disclosure due to 'userNameToken' (PK67282).

  - A user locked by the underlying OS may be able to authenticate via the administrative console (PK67909).

  - Web authentication options 'Authenticate when any URI is accessed' and 'Use available authentication data when an unprotected URI is accessed' are ignored. Servlets with no security constraints are not authenticated and usernames with the '@' symbol fail to authenticate  (PK71826).

  - WS-Security in JAX-WS does not remove UsernameTokens from client cache on failed logins (PK72435).

  - SSL traffic is routed over unencrypted TCP routes (PK74777). 

IBM WebSphere Application Server 7.0 before Fix Pack 1 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities. 

  - The PerfServlet code writes sensitive information in     the 'systemout.log' and ffdc files, provided     Performance Monitoring Infrastructure (PMI) is enabled.     (PK63886)  
  - A vulnerability in feature pack for web services could     lead to information disclosure due to 'userNameToken'.
    (PK67282)  
  - A user locked by the underlying OS may be able to     authenticate via the administrative console. (PK67909)

  - Web authentication options 'Authenticate when any URI is     accessed' and 'Use available authentication data when an     unprotected URI is accessed' are ignored. Servlets with     with no security constraints are not authenticated and     usernames with '@' symbol fail to authenticate.
    (PK71826)

  - WS-Security in JAX-WS does not remove UsernameTokens     from client cache on failed logins. (PK72435)

  - WSPolicy discloses password in SOAP messages even though     IDAssertion.isUsed is set to true, and a simple user     name token policyset is used. (PK73573)

  - SSL traffic is routed over unencrypted TCP routes.
    (PK74777)

  - By sending a specially crafted request, it may be     possible for a remote attacker to gain access to     certain JSP pages that require authorization.
    (PK75248)

IBM WebSphere Application Server 6.0.2 before Fix Pack 31 appears to be running on the remote host.  Such versions are reportedly affected by the following vulnerabilities :

  - By sending a specially crafted HTTP request with the 'Host' header field set to more than 256 bytes, it may be possible to crash the remote application server (PK69371).
 - An unspecified security exposure vulnerability exists if the 'fileServing' feature is enabled (PK64302).
 - Web services security fails to honor Certificate Revocation Lists (CRL) configured in Certificate Store Collections (PK61258).

IBM WebSphere Application Server 6.0.2 before Fix Pack 31 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :
 
  - By sending a specially crafted HTTP request with the     'Host' header field set to more than 256 bytes, it may     be possible to crash the remote application server.
    (PK69371)  
  - An unspecified security exposure vulnerability exists if     'fileServing' feature is enabled. (PK64302)

  - Web services security fails to honor Certificate     Revocation Lists (CRL) configured in Certificate Store     Collections. (PK61258)

  - Provided Performance Monitoring Infrastructur (PMI) is     enabled, it may be possible for an local attacker to     obtain sensitive information.

 IBM WebSphere Application Server 6.1 before Fix Pack 19 appears to be running on the remote host.  Such versions reportedly have an as-yet unspecified security exposure when the 'FileServing' feature in the Servlet Engine / Web Container component is enabled.  (PK64302).

ID	Name	Product	Family	Severity
4929	IBM WebSphere Application Server 6.1 < Fix Pack 21 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
35659	IBM WebSphere Application Server 6.1 < Fix Pack 21 Multiple Flaws	Nessus	Web Servers	medium
4783	IBM WebSphere Application Server 7.0 < Fix Pack 1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
35082	IBM WebSphere Application Server 7.0 < Fix Pack 1	Nessus	Web Servers	medium
4725	IBM WebSphere Application Server < 6.0.2.31 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
34501	IBM WebSphere Application Server < 6.0.2.31 Multiple Vulnerabilities	Nessus	Web Servers	medium
4685	IBM WebSphere Application Server 6.1 < Fix Pack 19 Unspecified Vulnerability	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2009-0434

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium