IBM WebSphere Application Server < 6.1.0.17 Multiple Vulnerabilities

high Nessus Plugin ID 33127

Language:

Synopsis

The remote application server is affected by multiple vulnerabilities.

Description

IBM WebSphere Application Server 6.1 before Fix Pack 17 appears to be running on the remote host. As such, it is reportedly affected by multiple flaws :

- An attribute in a SOAP security header may cause a security exposure in Web Services applications.
(PK61315)

- An unspecified vulnerability in the native AIO library when running on AIX 5.3 may result in a denial of service when calling into the 'libibmaio.so' library or the 'getEvent() native method. (PK64529)

Solution

If using WebSphere Application Server, apply Fix Pack 17 (6.1.0.17) or later.

Otherwise, if using embedded WebSphere Application Server packaged with Tivoli Directory Server, apply the latest recommended eWAS fix pack.

Plugin Details

Severity: High

ID: 33127

File Name: websphere_6_1_0_17.nasl

Version: 1.17

Type: remote

Family: Web Servers

Published: 6/10/2008

Updated: 8/6/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Required KB Items: www/WebSphere

Exploit Ease: No known exploits are available

Patch Publication Date: 6/3/2008

Reference Information

CVE: CVE-2008-2550, CVE-2009-0435

BID: 29543, 33700

Secunia: 30526

Detections

Analytics