Vulnerability CVE-2014-3092 - CERT Civis.Net

Vulnerability Name:

CVE-2014-3092 (CCN-94258)

Assigned:

2014-09-09

Published:

2014-09-09

Updated:

2017-08-29

Summary:

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVSS v3 Severity:

3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2014-3092

Source: CCN
Type: IBM Security Bulletin 1682787
Security vulnerability in Jazz Team Server affects multiple IBM Rational products based on IBM's Jazz technology (CVE-2014-3092)

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21682787

Source: CCN
Type: IBM Security Bulletin 1686166
Security vulnerability in Jazz Team Server affects Rational Insight (CVE-2014-3092)

Source: CCN
Type: IBM Security Bulletin 1686167
Security vulnerability in Jazz Team Server affects Rational Reporting for Development Intelligence (CVE-2014-3092)

Source: CCN
Type: BID-69775
IBM Jazz Team Server CVE-2014-3092 Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
ibm-jazz-cve20143092-info-disc(94258)

Source: XF
Type: UNKNOWN
ibm-rclm-cve20143092-cookie(94258)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:rational_doors_next_generation:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:1.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:4.03:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:4.04:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:4.05:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:4.06:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_rhapsody_design_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:5.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:rational_team_concert:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:5.0:*:*:*:*:*:*:*

AND

cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0:*:*:*:*:*:*:*

Denotes that component is vulnerable