Detections
Analytics
IBM WebSphere Application Server < 6.0.2.31 Multiple Vulnerabilities
medium Nessus Plugin ID 34501
Language:
Synopsis
The remote application server is affected by multiple vulnerabilities.Description
IBM WebSphere Application Server 6.0.2 before Fix Pack 31 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities :- By sending a specially crafted HTTP request with the 'Host' header field set to more than 256 bytes, it may be possible to crash the remote application server.
(PK69371)
- An unspecified security exposure vulnerability exists if 'fileServing' feature is enabled. (PK64302)
- Web services security fails to honor Certificate Revocation Lists (CRL) configured in Certificate Store Collections. (PK61258)
- Provided Performance Monitoring Infrastructur (PMI) is enabled, it may be possible for an local attacker to obtain sensitive information.
Solution
Apply Fix Pack 31 (6.0.2.31) or later.See Also
http://www-01.ibm.com/support/docview.wss?uid=swg1PK69371
Plugin Details
Severity: Medium
ID: 34501
File Name: websphere_6_0_2_31.nasl
Version: 1.21
Type: remote
Family: Web Servers
Published: 10/27/2008
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Required KB Items: www/WebSphere
Exploit Ease: No known exploits are available
Patch Publication Date: 10/20/2008
Reference Information
CVE: CVE-2008-4111, CVE-2008-4678, CVE-2008-4679, CVE-2009-0434