The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - If the admin console is directly accessed from HTTP,     the console fails to redirect the connection to a     secure login page. (PK77010)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure.     (PK77495)  

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - After upgrading from WebSphere Application Server V6.1     to V7.0 with tracing enabled, an attacker may be able     view sensitive information by viewing the trace files.
    (PK80337)  

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - Vulnerabilities in Apache HTTP server could allow a     local user to gain elevated privileges. (PK86232)

  - A error in 'wsadmin' could allow a remote attacker     to bypass security restrictions. (PK86328)    
  - A vulnerability in portlet serving enable parameter     could allow an attacker to bypass security restrictions     and gain unauthorized access to the application.     (PK89385)

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities.

  - Invoking an MBean that does not have type key-property results in a NullPointerException. (PK78743)

  - Deployment fails to properly handle password in webservices client modules. (PK79275)

  - IBM-portlet-ext.xmi is not reading correctly the portlet serving enable parameter. (PK89385)

  - An attacker may be able to obtain sensitive information, caused by an error during the migration from WebSphere Application Server 6.1 to 7.0 when tracing is enabled. (PK80337)

  - Deploying new applications on WebSphere Application Server for z/OS prior to 1.8 can result in the application being saved on the file system with insecure permissions. (PK83308)

  - A security-bypass vulnerability due to a design error in the Single Sign-on with SPENEGO implementation. When setting the custom property 'ws.webcontainer.invokefilterscompatibility' to true, an attacker can bypass the SSO authentication on security URLs. (PK77465)

 A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security is configured with Identity Assertion. (PK83097)

IBM WebSphere Application Server 6.1 before Fix Pack 25 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure. (PK77495)

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - In certain cases sensitive information may appear in     migration trace. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - Sensitive information might appear in trace files.
    (PK80337)

  - XML digital signature is affected by a security issue.
    (PK80596)

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - IBM Stax XMLStreamWriter may write to an incorrect XML     file, and hence is susceptible to a XML fuzzing attack.
    (PK84015)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - A security bypass caused by inbound requests that lack     a SOAPAction or WS-Addressing Action. (PK72138)

ID	Name	Product	Family	Severity
40823	IBM WebSphere Application Server 7.0 < Fix Pack 5	Nessus	Web Servers	medium
5142	IBM WebSphere Application Server 7.0 < Fix Pack 5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
39450	IBM WebSphere Application Server < 6.1.0.25 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2009-2088

critical

Tenable Plugins

medium

high

medium