IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.

IBM WebSphere Application Server 6.1 before Fix Pack 25 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure. (PK77495)

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - In certain cases sensitive information may appear in     migration trace. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - Sensitive information might appear in trace files.
    (PK80337)

  - XML digital signature is affected by a security issue.
    (PK80596)

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - IBM Stax XMLStreamWriter may write to an incorrect XML     file, and hence is susceptible to a XML fuzzing attack.
    (PK84015)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

IBM WebSphere Application Server 7.0 before Fix Pack 3 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities.

  - Under certain conditions it may be possible to access administrative console user sessions. (PK74966)

  - The adminitrative console is affected by a cross-site scripting vulnerability. (PK77505)

  - If APAR PK41002 has been applied, an unspecified vulnerability in JAX-RPC WS-Security component could incorrectly validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere Application Server are affected by cross-site scripting vulnerabilities. (PK76720)

  - Certain files associated with interim fixes for Unix-based versions of IBM WebSphere Application Server are built with insecure file permissions. (PK77590)

  - The Web Services Security component is affected by an unspecified security issue in digital-signature specification. (PK80596)

  - It may be possible for an attacker to read arbitrary application-specific war files. (PK81387)

  - The application is prone to a session-highjacking vulnerability related to the 'forced logout' feature. (PK74966)

  - A vulnerability affects the XML Digital Signature Specification in the web services security component. (PK80596)

IBM WebSphere Application Server 7.0 before Fix Pack 3 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Under certain conditions it may be possible to access     administrative console user sessions. (PK74966)

  - The administrative console is affected by a cross-site     scripting vulnerability. (PK77505)

  - If APAR PK41002 has been applied, a vulnerability in the     JAX-RPC WS-Security component could incorrectly     validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere     Application Server are affected by cross-site scripting     vulnerabilities. (PK76720)

  - Certain files associated with interim fixes for Unix-     based versions of IBM WebSphere Application Server are     built with insecure file permissions. (PK77590)

  - The Web Services Security component is affected by an     unspecified security issue in digital-signature     specification. (PK80596)

  - It may be possible for an attacker to read arbitrary     application-specific war files. (PK81387)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

IBM WebSphere Application Server 6.1.0 before Fix Pack 25 appears to be running on the remote host. Such versions are reportedly affected by multiple vulnerabilities : 

  - The administrative component's secure login page fails to redirect to an 'https: //' page when it receives an 'http: //' request. (PK77010)

  - An unspecified security issue affects 'wsadmin' in the 'SystemManagement/Repository' component. (PK77235)

  - An information disclosure vulnerability affects the 'Configservice APIs' in the Administrative Console' component. (PK84999)

  - An unspecified vulnerability affects the 'Security' component, which permits 'non-standard HTTP methods'. (PK773246)

  - A security-bypass vulnerability when users use JAX-WS applications with a WS-Security policy set at the operational level. (PK87767)

  - A denial-of-service vulnerability caused because the application uses insecure obfuscation in web services. (PK79275)

  - An information disclosure vulnerability affecting the Migration component when WAS is migrated from version 6.1 to 7.0 and tracing is enabled. (PK80337)

  - A security-bypass issue caused by an error in the Single Sign-on with SPNEGO implementation. (PK77465)

  - A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security with Identity Assertion. (PK83097)

ID	Name	Product	Family	Severity
39450	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus	Web Servers	medium
4991	IBM WebSphere Application Server 7.0 < Fix Pack 3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
36133	IBM WebSphere Application Server 7.0 < Fix Pack 3	Nessus	Web Servers	high
5077	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2009-0903

critical

Tenable Plugins

medium

high

high

high