Detections
Analytics
IBM WebSphere Application Server 6.0 < 6.0.2.41 Multiple Vulnerabilities
medium Nessus Plugin ID 45429
Language:
Synopsis
The remote application server is affected by multiple vulnerabilities.Description
IBM WebSphere Application Server 6.0 before Fix Pack 41 for 6.0.2 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities :- An unspecified cross-site scripting vulnerability in the Administration Console. (PK97376)
- An error when defining a wsadmin scripting 'J2CConnectionFactory' object results in passwords being stored unencrypted in the resources.xml file. (PK95089)
- An error related to the ORB ListenerThread could allow remote, authenticated users to cause a denial of service.
(PK93653)
- WS-Security processing problems with PKIPath and PKCS#7 tokens could lead to a security bypass vulnerability. (PK96427)
- An OutOfMemory condition related to the Deployment Manager and nodeagent cause lead to a denial of service. (PM05663)
Solution
Apply Fix Pack 41 for version 6.0.2 (6.0.2.41) or later.See Also
http://www-01.ibm.com/support/docview.wss?uid=swg27004980
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg27006876
Plugin Details
Severity: Medium
ID: 45429
File Name: websphere_6_0_2_41.nasl
Version: 1.12
Type: remote
Family: Web Servers
Published: 4/6/2010
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Required KB Items: www/WebSphere
Exploit Ease: No known exploits are available
Patch Publication Date: 3/29/2009
Vulnerability Publication Date: 3/29/2010
Reference Information
CVE: CVE-2010-0768, CVE-2010-0769, CVE-2010-0770, CVE-2010-0774, CVE-2010-0775