The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors.

IBM WebSphere Application Server 6.1.0 before Fix Pack 27 appears to be running on the remote host.  Such versions are potentially affected by multiple issues : 

  - Eclipse help system included with WebSphere Application Server is affected by a cross-site scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application Server for z/OS prior to 1.8 are saved on the file system with insecure privileges resulting in disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using wsadmin scripts, the password value may appear in FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service issue. (PK88341)

  - Due to an error in expat XML parser APR-util is affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service attack due to errors in fix packs 6.1.0.23 and 6.1.0.25. (PK91709)

IBM WebSphere Application Server 6.1 before Fix Pack 27 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - The Eclipse help system included with WebSphere     Application Server is affected by a cross-site     scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions     using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using     wsadmin scripts, the password value may appear in     FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service     issue. (PK88341)

  - Due to an error in expat XML parser, APR-util is     affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service     attack due to errors in Fix Packs 6.1.0.23 and     6.1.0.25. (PK91709)

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - Non-standard HTTP methods are allowed. (PK73246)

  - If the admin console is directly accessed from HTTP,     the console fails to redirect the connection to a     secure login page. (PK77010)

  - An error in Single Sign-on (SSO) with SPNEGO     implementation could allow a remote attacker     to bypass security restrictions. (PK77465)

  - 'wsadmin' is affected by a security exposure.     (PK77495)  

  - Security flag 'isSecurityEnabled' is incorrectly set     after migrating from VMM. (PK78134)

  - Use of insecure password obfuscation algorithm by Web     services could result in weaker than expected security     provided the client module specifies a password in     ibm-webservicesclient-bind.xmi and target environment     has custom password encryption enabled. (PK79275)

  - After upgrading from WebSphere Application Server V6.1     to V7.0 with tracing enabled, an attacker may be able     view sensitive information by viewing the trace files.
    (PK80337)  

  - If CSIv2 Security is configured with Identity     Assertion, it may be possible for a remote     attacker to bypass security restrictions. (PK83097)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - Configservice APIs could display sensitive information.
    (PK84999)

  - Vulnerabilities in Apache HTTP server could allow a     local user to gain elevated privileges. (PK86232)

  - A error in 'wsadmin' could allow a remote attacker     to bypass security restrictions. (PK86328)    
  - A vulnerability in portlet serving enable parameter     could allow an attacker to bypass security restrictions     and gain unauthorized access to the application.     (PK89385)

IBM WebSphere Application Server 7.0 before Fix Pack 5 appears to be running on the remote host.  Such versions are reportedly affected by multiple vulnerabilities.

  - Invoking an MBean that does not have type key-property results in a NullPointerException. (PK78743)

  - Deployment fails to properly handle password in webservices client modules. (PK79275)

  - IBM-portlet-ext.xmi is not reading correctly the portlet serving enable parameter. (PK89385)

  - An attacker may be able to obtain sensitive information, caused by an error during the migration from WebSphere Application Server 6.1 to 7.0 when tracing is enabled. (PK80337)

  - Deploying new applications on WebSphere Application Server for z/OS prior to 1.8 can result in the application being saved on the file system with insecure permissions. (PK83308)

  - A security-bypass vulnerability due to a design error in the Single Sign-on with SPENEGO implementation. When setting the custom property 'ws.webcontainer.invokefilterscompatibility' to true, an attacker can bypass the SSO authentication on security URLs. (PK77465)

 A security-bypass vulnerability due to an unspecified error when configured with CSIv2 Security is configured with Identity Assertion. (PK83097)

ID	Name	Product	Family	Severity
5183	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
41057	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus	Web Servers	medium
40823	IBM WebSphere Application Server 7.0 < Fix Pack 5	Nessus	Web Servers	medium
5142	IBM WebSphere Application Server 7.0 < Fix Pack 5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2009-2091

high

Tenable Plugins

medium

medium

medium

high