Detections
Analytics
IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.4 Multiple Vulnerabilities
medium Nessus Plugin ID 77710
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The remote host is running a version 8.1.4.x of IBM Rational License Key Server Administration and Reporting Tool (RLKS) that is prior to 8.1.4.4. It is, therefore, affected by multiple vulnerabilities :- The secure flag for session cookies is not properly set when in SSL mode. An attacker can exploit this vulnerability to capture sensitive information from a cookie by intercepting its transmission. (CVE-2014-0909)
- An information disclosure vulnerability exists that allows an attacker to gain access to license usage data by using a specially crafted SPARQL query.
(CVE-2014-3079)
- An unspecified vulnerability exists that is related to user session cookies, which an attacker can exploit to impersonate a legitimate user. (CVE-2014-4756)
Solution
Upgrade to Rational License Key Server Fix Pack 4 (8.1.4.4) or later.See Also
Plugin Details
Severity: Medium
ID: 77710
File Name: ibm_rlks_swg21681449.nasl
Version: 1.5
Type: remote
Family: CGI abuses
Published: 9/16/2014
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.5
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:ibm:rational_license_key_server
Required KB Items: installed_sw/IBM Rational License Key Server Administration and Reporting Tool
Exploit Ease: No known exploits are available
Patch Publication Date: 9/4/2014
Vulnerability Publication Date: 9/4/2014