The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request.

IBM WebSphere Application Server 6.1 before Fix Pack 45 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - An error exists related to 'Application Snoop Servlet'     and missing access controls. This error can allow     sensitive information to be disclosed. Note that     exploiting this issue requires that the default     'Application Snoop Servlet' be installed and running.
    (CVE-2012-2170, PM56183)

  - Several errors exist related to SSL/TLS that can allow     an attacker to carry out denial of service attacks     against the application. (CVE-2012-2190, CVE-2012-2191,     PM66218)

  - Unspecified cross-site scripting issues exist related to     the administrative console. (CVE-2012-3293, PM60839)

  - An unspecified error in the 'ISC Console' can allow a     remote attacker to take over a valid user's session.
    (CVE-2012-3304, PM54356)

  - An unspecified directory traversal error exists that     can allow remote attackers to overwrite files outside     the application's deployment directory. (CVE-2012-3305,     PM62467)

  - When multi-domain support is enabled, the application     does not properly purge passwords from the     authentication cache. (CVE-2012-3306, PM66514)

  - An error exists related to 'Federated Repositories',     'IIOP' connections, 'CBIND' checking and 'Optimized     Local Adapters' that can allow a remote attacker to     bypass security restrictions. Note that this issue     affects the application when running on z/OS.
    (CVE-2012-3311, PM61388)

  - The fix contained in PM44303 contains an error that     can allow an authenticated attacker to bypass security     restrictions and gain administrative access to the     application. (CVE-2012-3325, PM71296)

IBM WebSphere Application Server 8.0 before Fix Pack 4 appears to be running on the remote host and is potentially affected by the following vulnerabilities :

  - An input validation error exists related to the 'Eclipse     Help System' that can allow arbitrary redirect responses     to HTTP requests. (CVE-2012-2159, CVE-2012-2161,     PM62795)

  - An error exists related to 'Application Snoop Servlet'     and missing access controls. This error can allow     sensitive information to be disclosed. Note that     exploiting this issue requires that the default     'Application Snoop Servlet' be installed and running.
    (CVE-2012-2170, PM56183)

  - Several errors exist related to SSL/TLS that can allow     an attacker to carry out denial of service attacks     against the application. (CVE-2012-2190, CVE-2012-2191,     PM66218)

  - Unspecified cross-site scripting issues exist related to     the administrative console. (CVE-2012-3293, PM60839)

IBM WebSphere Application Server 7.0 before Fix Pack 23 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - A security exposure when using WS-Security could result     in a user gaining elevated privileges in applications     using JAX-RPC. (PM45181 / CVE-2011-1377)

  - SSL client certificate authentication can be bypassed     when all of the following are true (PM52351) :

      - SSL is enabled with 'SSLEnable'
      - SSL client authentication is enabled with         'SSLClientAuth required_reset'. This is not enabled         by default. Also note, 'SSLClientAuth required' is         not affected.
      - SSLv2 has not been disabled with         'SSLProtocolDisable SSLv2'
      - 'SSLClientAuthRequire' is not enabled

  - Unspecified cross-site scripting issues exist related to     the administrative console. (PM52274, PM53132)

  - An error exists related to 'Application Snoop Servlet'     and missing access controls. This error can allow     sensitive information to be disclosed. (PM56183)

  - An issue related to the weak randomization of Java hash     data structures can allow a remote attacker to cause a     denial of service with maliciously crafted POST requests.
    (PM53930)

ID	Name	Product	Family	Severity
62394	IBM WebSphere Application Server 6.1 < Fix Pack 45 Multiple Vulnerabilities	Nessus	Web Servers	medium
61459	IBM WebSphere Application Server 8.0 < Fix Pack 4 Multiple Vulnerabilities	Nessus	Web Servers	medium
59728	IBM WebSphere Application Server 7.0 < Fix Pack 23 Multiple Vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2012-2170

high

Tenable Plugins

medium

medium

critical