CVE-2014-6140

Description

IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal.

References

http://www.securitytracker.com/id/1031306

http://www.securityfocus.com/bid/71424

http://www.securityfocus.com/archive/1/534131/100/0/threaded

http://www-01.ibm.com/support/docview.wss?uid=swg21691701

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3