The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.

IBM WebSphere Application Server 6.1 before Fix Pack 23 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities :

  - Provided an attacker has valid credentials, it may be possible to hijack an authenticated session. (PK66676)

  - It may be possible for a remote attacker to redirect users to arbitrary sites using ibm_security_logout servlet. (PK71126) 

  - Under certain conditions it may be possible to access administrative console user sessions. (PK74966)

  - If APAR PK41002 has been applied, an unspecified vulnerability in JAX-RPC WS-Security component could incorrectly validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere Application Server are affected by cross-site scripting vulnerabilities. (PK76720)

  - The adminitrative console is affected by a cross-site scripting vulnerability. (PK77505)

  - It may be possible for an attacker to read arbitrary application-specific war files. (PK81387)

  - A session highjacking vulnerability exists in the 'forced logout' feature. (PK74966)

IBM WebSphere Application Server 7.0 before Fix Pack 3 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities.

  - Under certain conditions it may be possible to access administrative console user sessions. (PK74966)

  - The adminitrative console is affected by a cross-site scripting vulnerability. (PK77505)

  - If APAR PK41002 has been applied, an unspecified vulnerability in JAX-RPC WS-Security component could incorrectly validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere Application Server are affected by cross-site scripting vulnerabilities. (PK76720)

  - Certain files associated with interim fixes for Unix-based versions of IBM WebSphere Application Server are built with insecure file permissions. (PK77590)

  - The Web Services Security component is affected by an unspecified security issue in digital-signature specification. (PK80596)

  - It may be possible for an attacker to read arbitrary application-specific war files. (PK81387)

  - The application is prone to a session-highjacking vulnerability related to the 'forced logout' feature. (PK74966)

  - A vulnerability affects the XML Digital Signature Specification in the web services security component. (PK80596)

IBM WebSphere Application Server 6.1 before Fix Pack 23 appears to be installed on the remote host.  Such versions are reportedly affected by multiple vulnerabilities :

  - Provided an attacker has valid credentials, it may be     possible to hijack an authenticated session. (PK66676)

  - It may be possible for a remote attacker to redirect     users to arbitrary sites using ibm_security_logout     servlet. (PK71126)

  - Under certain conditions it may be possible to access     administrative console user sessions. (PK74966)

  - If APAR PK41002 has been applied, a vulnerability in     the JAX-RPC WS-Security component could incorrectly     validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere     Application Server are affected by cross-site scripting     vulnerabilities. (PK76720)

  - The administrative console is affected by a cross-site     scripting vulnerability. (PK77505)

  - It may be possible for an attacker to read arbitrary     application-specific war files. (PK81387)

IBM WebSphere Application Server 7.0 before Fix Pack 3 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Under certain conditions it may be possible to access     administrative console user sessions. (PK74966)

  - The administrative console is affected by a cross-site     scripting vulnerability. (PK77505)

  - If APAR PK41002 has been applied, a vulnerability in the     JAX-RPC WS-Security component could incorrectly     validate 'UsernameToken'. (PK75992)

  - Sample applications shipped with IBM WebSphere     Application Server are affected by cross-site scripting     vulnerabilities. (PK76720)

  - Certain files associated with interim fixes for Unix-     based versions of IBM WebSphere Application Server are     built with insecure file permissions. (PK77590)

  - The Web Services Security component is affected by an     unspecified security issue in digital-signature     specification. (PK80596)

  - It may be possible for an attacker to read arbitrary     application-specific war files. (PK81387)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

ID	Name	Product	Family	Severity
4996	IBM WebSphere Application Server < 6.1.0.23 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
4991	IBM WebSphere Application Server 7.0 < Fix Pack 3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
36161	IBM WebSphere Application Server < 6.1.0.23 Multiple Flaws	Nessus	Web Servers	high
36133	IBM WebSphere Application Server 7.0 < Fix Pack 3	Nessus	Web Servers	high

Detections

Analytics

CVE-2009-1172

critical

Tenable Plugins

high

high

high

high