IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.

The version of IBM HTTP Server running on the remote host is affected by a vulnerability. IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.33.  Such versions are potentially affected by multiple vulnerabilities :

 - A cross-site scripting (XSS) flaw exists within the Administration Console, where user input is improperly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6323, PI04777, PI04880)
 - A denial of service flaw exists within the Global Security Kit when handling SSLv2 resumption during the SSL/TLS handshake.  This could allow a remote attacker to crash the program. (CVE-2013-6329, PI05309)
 - A buffer overflow flaw exists in the HTTP server with the 'mod_dav' module when using add-ons.  This could allow a remote attacker to cause a buffer overflow and a denial of service. (CVE-2013-6438, PI09345)
 - An XSS flaw exists within 'OAuth' where user input is not properly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6738, PI05661)
 - A denial of service (DoS) flaw exists within the Global Security Kit when handling the X.509 certificate chain during the initiation of an SSL/TLS connection.  A remote attacker, using a malformed certificate chain, could cause the client or server to crash by hanging the Global Security Kit. (CVE-2013-6747, PI09443)
 - A DoS flaw exists within the Apache Commons 'FileUpload' when parsing a content-type header for a multipart request.  A remote attacker, using a specially crafted request, could crash the program. (CVE-2014-0050, PI12648, PI12926 and PI13162)
 - A DoS flaw exists in the 'mod_log_config' when logging a cookie with an unassigned value.  A remote attacker, using a specially crafted request, can cause the program to crash. (CVE-2014-0098, PI13028)
 - A remote code execution flaw exists with Apache Struts.  The failure to restrict setting of class loader attributes could allow a remote attacker to execute arbitrary script code. (CVE-2014-0114, PI17190)
 - An information disclosure flaw exists in the 'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.  This many allow a remote attacker to gain timing information intended to be protected by encryption. (CVE-2014-0453)
 - A flaw exists within 'com.sun.jndi.dns.DnsClient' related to the randomization of query IDs. This could  allow a remote attacker to conduct spoofing attacks. (CVE-2014-0460)
 - A DoS flaw exists in a web server plugin on servers configured to retry failed POST requests.  This could allow a remote attacker to crash the application. (CVE-2014-0859, PI08892)
 - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom' cryptographic providers by generating numbers in a predictable manner.  This could allow a remote attacker to easily guess the output of the random number generator. (CVE-2014-0878)
 - An information disclosure flaw exists within Proxy and ODR servers.  This could allow a remote attacker, using a specially crafted request, to gain access to potentially sensitive information. (CVE-2014-0891, PI09786)
 - A DoS flaw exists within the IBM Security Access Manager for Web with the Reverse Proxy component.  This could allow a remote attacker, using specially crafted TLS traffic, to cause the application on the system to become unresponsive. (CVE-2014-0963, PI17025)
 - An information disclosure flaw exists when handling SOAP responses.  This could allow a remote attacker to potentially gain access to sensitive information. (CVE-2014-0965, PI11434)
 - An information disclosure flaw exists.  A remote attacker, using a specially crafted URL, could gain access to potentially sensitive information. (CVE-2014-3022, PI09594)
 - An unspecified flaw exists that may allow an attacker to gain elevated privileges.  No further details have been provided.

The version of IBM Tivoli Storage Manager installed on the remote host is affected by a denial of service vulnerability. A remote attacker can exploit this issue via malformed X.509 certificate chain to cause the host to become unresponsive.

The remote Informix server ships with a version of IBM's Global Security kit (GSKit) library that is affected by a denial of service vulnerability. A remote attacker can exploit this issue via malformed X.509 certificate chain to cause the host to become unresponsive.

Note that this plugin only checks the version of IBM Informix Server and GSKit. It does not check for the presence of any workaround.

IBM WebSphere Application Server 8.0 prior to Fix Pack 9 is running on the remote host. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting flaw exists within the     Administration Console, where user input is improperly     validated. This could allow a remote attacker, with a     specially crafted request, to execute arbitrary script     code within the browser / server trust relationship.
    (CVE-2013-6323, PI04777 and PI04880)

  - A denial of service flaw exists within the Global     Security Kit when handling SSLv2 resumption during the     SSL/TLS handshake. This could allow a remote attacker     to crash the program. (CVE-2013-6329, PI05309)

  - A buffer overflow flaw exists in the HTTP server with     the mod_dav module when using add-ons. This could allow     a remote attacker to cause a buffer overflow and a     denial of service. (CVE-2013-6438, PI09345)

  - A cross-site scripting flaw exists within OAuth where     user input is not properly validated. This could allow     a remote attacker, with a specially crafted request, to     execute arbitrary script code within the browser /     server trust relationship. (CVE-2013-6738, PI05661)

  - A denial of service flaw exists within the Global     Security Kit when handling X.509 certificate chain     during the initiation of a SSL/TLS connection. A remote     attacker, using a malformed certificate chain, could     cause the client or server to crash by hanging the     Global Security Kit. (CVE-2013-6747, PI09443)

  - A denial of service flaw exists within the Apache     Commons FileUpload when parsing a content-type header     for a multipart request. A remote attacker, using a     specially crafted request, could crash the program.
    (CVE-2014-0050, PI12648, PI12926 and PI13162)

  - A flaw exists in the Elliptic Curve Digital Signature     Algorithm implementation which could allow a malicious     process to recover ECDSA nonces.
    (CVE-2014-0076, PI19700)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - An information disclosure flaw exists in the     'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.
    This many allow a remote attacker to gain timing     information intended to be protected by encryption.
    (CVE-2014-0453)

  - A flaw exists with 'com.sun.jndi.dns.DnsClient' related     to the randomization of query IDs. This could allow a     remote attacker to conduct spoofing attacks.
    (CVE-2014-0460)

  - A flaw exists in the Full and Liberty profiles. A remote     attacker, using a specially crafted request, could gain     access to arbitrary files. (CVE-2014-0823, PI05324)

  - An information disclosure flaw exists within the     Administrative Console. This could allow a network     attacker, using a specially crafted request, to gain     privileged access. (CVE-2014-0857, PI07808)

  - A denial of service flaw exists in a web server plugin     on servers configured to retry failed POST request. This     could allow a remote attacker to crash the application.
    (CVE-2014-0859, PI08892)

  - An information disclosure flaw exists within Proxy and     ODR servers. This could allow a remote attacker, using a     specially crafted request, to gain access to potentially     sensitive information. (CVE-2014-0891, PI09786)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

IBM WebSphere Application Server 7.0 prior to Fix Pack 33 is running on the remote host. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting flaw exists within the     Administration Console, where user input is improperly     validated. This could allow a remote attacker, with a     specially crafted request, to execute arbitrary script     code within the browser / server trust relationship.
    (CVE-2013-6323, PI04777 and PI04880)

  - A denial of service flaw exists within the Global     Security Kit when handling SSLv2 resumption during the     SSL/TLS handshake. This could allow a remote attacker     to crash the program. (CVE-2013-6329, PI05309)

  - A buffer overflow flaw exists in the HTTP server with     the mod_dav module when using add-ons. This could allow     a remote attacker to cause a buffer overflow and a     denial of service. (CVE-2013-6438, PI09345)

  - A cross-site scripting flaw exists within OAuth where     user input is not properly validated. This could allow     a remote attacker, with a specially crafted request, to     execute arbitrary script code within the browser /     server trust relationship. (CVE-2013-6738, PI05661)

  - A denial of service flaw exists within the Global     Security Kit when handling X.509 certificate chain     during the initiation of an SSL/TLS connection. A remote     attacker, using a malformed certificate chain, could     cause the client or server to crash by hanging the     Global Security Kit. (CVE-2013-6747, PI09443)

  - A denial of service flaw exists within the Apache     Commons FileUpload when parsing a content-type header     for a multipart request. A remote attacker, using a     specially crafted request, could crash the program.
    (CVE-2014-0050, PI12648, PI12926 and PI13162)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - A remote code execution flaw exists with Apache Struts.
    The failure to restrict setting of Class loader     attributes could allow a remote attacker to     execute arbitrary script code. (CVE-2014-0114, PI17190)

  - An information disclosure flaw exists in the     'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.
    This many allow a remote attacker to gain timing     information intended to be protected by encryption.
    (CVE-2014-0453)

  - A flaw exists within 'com.sun.jndi.dns.DnsClient'     related to the randomization of query IDs. This could     allow a remote attacker to conduct spoofing attacks.
    (CVE-2014-0460)

  - A denial of service flaw exists in a web server plugin     on servers configured to retry failed POST request. This     could allow a remote attacker to crash the application.
    (CVE-2014-0859, PI08892)

  - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom'     cryptographic providers by generating numbers in a     predictable manner. This could allow a remote attacker     to easily guess the output of the random number     generator. (CVE-2014-0878)

  - An information disclosure flaw exists within Proxy and     ODR servers. This could allow a remote attacker, using a     specially crafted request, to gain access to potentially     sensitive information. (CVE-2014-0891, PI09786)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

According to its version, the installation of IBM DB2 running on the remote host is version 9.8 prior or equal to Fix Pack 5. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists in the GSKit component when     initiating SSL/TLS connections due to improper handling     of malformed X.509 certificate chains. A remote attacker     can exploit this to cause a denial of service.
    (CVE-2013-6747)

  - Untrusted search path vulnerabilities exist in     unspecified setuid and setgid programs that allow a     local attacker to gain root privileges by using a     trojan horse library. (CVE-2014-0907)

  - An unspecified error exists in the reverse proxy GSKit     component that allows a remote attacker to exhaust CPU     resources by using crafted SSL messages, resulting in a     denial of service. (CVE-2014-0963)

  - An unspecified error exists during the handling of     SELECT statements with XML/XSLT functions that allows a     remote attacker to gain access to arbitrary files.
    (CVE-2014-8910)

  - A flaw exists in the LUW component when handling SQL     statements with unspecified Scaler functions. A remote,     authenticated attacker can exploit this to cause a     denial of service. (CVE-2015-0157)

  - An unspecified flaw in the General Parallel File System     (GPFS) allows a local attacker to gain root privileges.
    CVE-2015-0197)

  - A flaw exists in the General Parallel File System     (GPFS), related to certain cipherList configurations,     that allows a remote attacker, using specially crafted     data, to bypass authentication and execute arbitrary     programs with root privileges. (CVE-2015-0198)

  - A denial of service vulnerability exists in the General     Parallel File System (GPFS) that allows a local attacker     to corrupt the kernel memory by sending crafted ioctl     character device calls to the mmfslinux kernel module.
    (CVE-2015-0199)

  - An information disclosure vulnerability exists in the     automated maintenance feature. An attacker with elevated     privileges, by manipulating a stored procedure, can     exploit this issue to disclose arbitrary files owned by     the DB2 fenced ID on UNIX/Linux or the administrator on     Windows. (CVE-2015-1883)

  - A flaw exists in the Data Movement feature when handling     specially crafted queries. An authenticated, remote     attacker can exploit this to delete database rows from a     table without having the appropriate privileges.
    (CVE-2015-1922)

  - A flaw exists when handling SQL statements having     unspecified LUW Scaler functions. An authenticated,     remote attacker can exploit this to run arbitrary code,     under the privileges of the DB2 instance owner, or to     cause a denial of service. (CVE-2015-1935)

According to its version, the installation of DB2 9.7 running on the remote host is prior to Fix Pack 9a. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that allows denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that allows a local user to carry out     privilege escalation attacks. Note that this issue does     not affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that allows certain error cases to cause     100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 9.5 running on the remote host is prior or equal to Fix Pack 9 or 10. It is, therefore, reportedly affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 running on the remote host is version 9.1. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 3a. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 10.1 running on the remote host is prior to Fix Pack 3a. It is, therefore, affected by one or more of the following vulnerabilities :

  - The included version of GSKit contains an error     related to CBC-mode and timing that could allow an     attacker to recover plaintext from encrypted     communications. (CVE-2013-0169)

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

IBM WebSphere Application Server 8.5 prior to Fix Pack 8.5.5.2 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - Numerous errors exist related to the included IBM SDK     for Java (based on the Oracle JDK) that could allow     denial of service attacks and information disclosure.
    (CVE-2013-5372, CVE-2013-5780, CVE-2013-5803)

  - User input validation errors exist related to the     Administrative console and the Oauth component that     could allow cross-site scripting attacks.
    (CVE-2013-6725 / PM98132, CVE-2013-6323 / PI04777,     CVE-2013-6738 / PI05661)

  - An error exists due to a failure to properly     handle by web services endpoint requests that     could allow denial of service attacks.
    (CVE-2013-6325 / PM99450, PI08267)

  - An error exists in the included IBM Global Security     Kit related to SSL handling that could allow denial     of service attacks. (CVE-2013-6329 / PI05309)

  - A flaw exists with the 'mod_dav' module that is caused     when tracking the length of CDATA that has leading     white space. A remote attacker with a specially crafted     DAV WRITE request can cause the service to stop     responding. (CVE-2013-6438 / PI09345)

  - An error exists in the included IBM Global Security     Kit related to malformed X.509 certificate chain     handling that could allow denial of service attacks.
    (CVE-2013-6747 / PI09443)

  - An error exists in the included Apache Tomcat version     related to handling 'Content-Type' HTTP headers and     multipart requests such as file uploads that could     allow denial of service attacks. (CVE-2014-0050 /     PI12648, PI12926)

  - An unspecified error exists that could allow file     disclosures to remote unauthenticated attackers.
    (CVE-2014-0823 / PI05324)

  - An unspecified error exists related to the     Administrative console that could allow a security     bypass. (CVE-2014-0857 / PI07808)

  - An error exists related to a web server plugin and     retrying failed POST requests that could allow denial     of service attacks. (CVE-2014-0859 / PI08892)

  - An error exists related to the Proxy and ODR components     that could allow information disclosure. (CVE-2014-0891     / PI09786)

  - An unspecified error exists related to the 'Liberty     Profile' that could allow information disclosure.
    (CVE-2014-0896 / PI10134)

The remote host is running a version of IBM Tivoli Directory Server 6.1.0.x prior to 6.1.0.59, 6.2.0 prior to 6.2.0.34, or 6.3.0.x prior to 6.3.0.26, and a version of IBM Global Security Kit (GSKit) 7.0.x prior to 7.0.4.48 or 8.0.50.x prior to 8.0.50.16. It is, therefore, affected by a denial of service vulnerability due to a flaw in the GSKit library. An attacker can exploit this vulnerability via a malformed X.509 certificate chain to cause an application crash or hang.

ID	Name	Product	Family	Severity
144080	IBM HTTP Server 8.5.0.0 <= 8.5.5.1 / 8.0.0.0 <= 8.0.0.8 / 7.0.0.0 <= 7.0.0.31 / 6.1.0.0 <= 6.1.0.47 (238371)	Nessus	Web Servers	high
9699	IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
80478	IBM Tivoli Storage Manager Server 6.2 < 6.2.7 / 6.3 < 6.3.5 / 7.1 < 7.1.1 GSKit X.509 Certificate Chain DoS	Nessus	General	high
80476	Informix Server GSKit 7.x <= 7.0.4.47 / 8.0.50.x <= 8.0.50.13 X.509 Certificate Chain DoS	Nessus	Misc.	medium
76995	IBM WebSphere Application Server 8.0 < Fix Pack 9 Multiple Vulnerabilities	Nessus	Web Servers	high
76967	IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities	Nessus	Web Servers	high
76115	IBM DB2 9.8 <= Fix Pack 5 Multiple Vulnerabilities	Nessus	Databases	critical
76114	IBM DB2 9.7 < Fix Pack 9a Multiple Vulnerabilities	Nessus	Databases	high
76113	IBM DB2 9.5 <= Fix Pack 9 or 10 Multiple Vulnerabilities	Nessus	Databases	high
76112	IBM DB2 9.1 TLS/SSL Multiple DoS Vulnerabilities	Nessus	Databases	high
76111	IBM DB2 10.5 < Fix Pack 3a Multiple Vulnerabilities	Nessus	Databases	high
76110	IBM DB2 10.1 < Fix Pack 3a Multiple Vulnerabilities	Nessus	Databases	high
74235	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.2 Multiple Vulnerabilities	Nessus	Web Servers	high
72220	IBM Tivoli Directory Server < 6.1.0.59 / 6.2.0.34 / 6.3.0.26 with GSKit < 7.0.4.48 / 8.0.50.16 X.509 Certificate Chain DoS	Nessus	Windows	high

Detections

Analytics

CVE-2013-6747

high

Tenable Plugins

high

critical

high

medium

high

high

critical

high

high

high

high

high

high

high