Vulnerability Name:

CVE-2009-1172 (CCN-49532)

Assigned:2009-03-26
Published:2009-03-26
Updated:2014-10-24
Summary:The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2009-1172

Source: CCN
Type: SA34131
IBM WebSphere Application Server for z/OS Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: Vendor Advisory
34131

Source: CCN
Type: SA34461
IBM WebSphere Application Server Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
34461

Source: AIXAPAR
Type: UNKNOWN
PK75992

Source: CCN
Type: IBM APAR PK81211
SHIP APAR FIXES FOR H28W610 FIX PACK 6.1.0.23.

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg21367223

Source: CCN
Type: IBM Support & downloads
Fix list for WebSphere Application Server Version 6.0.2

Source: CONFIRM
Type: Patch
http://www-01.ibm.com/support/docview.wss?uid=swg27007951

Source: CONFIRM
Type: Patch
http://www-01.ibm.com/support/docview.wss?uid=swg27014463

Source: CCN
Type: OSVDB ID: 53251
IBM WebSphere Application Server (WAS) Web Services Security Component JAX-RPC WS-Security UsernameToken Object Validation Unspecified Issue

Source: BID
Type: UNKNOWN
34502

Source: CCN
Type: BID-34502
IBM WebSphere Application Server 'UsernameToken' Unspecified Security Vulnerability

Source: CCN
Type: BID-35610
IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
websphere-jax-rpc-security-bypass(49532)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm websphere application server 6.1
    ibm websphere application server 6.1.0
    ibm websphere application server 6.1.0.0
    ibm websphere application server 6.1.0.1
    ibm websphere application server 6.1.0.2
    ibm websphere application server 6.1.0.3
    ibm websphere application server 6.1.0.4
    ibm websphere application server 6.1.0.5
    ibm websphere application server 6.1.0.6
    ibm websphere application server 6.1.0.7
    ibm websphere application server 6.1.0.8
    ibm websphere application server 6.1.0.9
    ibm websphere application server 6.1.0.10
    ibm websphere application server 6.1.0.11
    ibm websphere application server 6.1.0.12
    ibm websphere application server 6.1.0.13
    ibm websphere application server 6.1.0.14
    ibm websphere application server 6.1.0.15
    ibm websphere application server 6.1.0.16
    ibm websphere application server 6.1.0.17
    ibm websphere application server 6.1.0.18
    ibm websphere application server 6.1.0.19
    ibm websphere application server 6.1.0.20
    ibm websphere application server 6.1.0.21
    ibm websphere application server 6.1.0.22
    ibm websphere application server 7.0
    ibm websphere application server 7.0.0.1
    ibm websphere application server 6.0.2
    ibm websphere application server 6.1
    ibm websphere application server 7.0