‫ IBM InfoSphere Information Server Multiple Vulnerabilities

IRCAD2013022454
ID: IRCAD2013022454
Release Date: 2013-01-30
Criticality level: Highly critical
 
Software:
IBM InfoSphere Information Server 8.x
 
Description:
Multiple vulnerabilities have been reported in IBM InfoSphere Information Server, which can be exploited by malicious, local user to disclose potentially sensitive information and gain escalated privileges, by malicious users to bypass certain security restrictions and compromise a vulnerable system, and by malicious people to conduct spoofing and cross-site scripting attacks and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) The application loads certain libraries in an insecure manner, which can be exploited to load arbitrary libraries by tricking a user into e.g. opening a file located on a remote WebDAV or SMB share.
3) Access to the troubleshooting functionality is not properly restricted and can be exploited to gain access to IBM InfoSphere Metadata Workbench.
4) The FastTrack client stores certain credentials in an insecure manner and can be exploited to disclose the credentials.
5) An error within the DataStage Administrator client can be exploited to gain escalated privileges.
NOTE: This vulnerability affects Windows versions only.
6) An error within certain authentication controls can be exploited to gain additional privileges.
7) Certain unspecified input is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.
8) An input validation error within Import Export Manager can be exploited to execute arbitrary commands.
9) The application bundles a vulnerable version of Eclipse Help System.
10) Certain unspecified input related to several web interfaces is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are reported in versions 8.1, 8.5, and 8.7.
 
Solution
Apply fix if available or contact IBM Support.
 
References:
 
Secunia:
 

نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 14 بهمن 1391

امتیاز

امتیاز شما
تعداد امتیازها:0