Vulnerability CVE-2015-1913 - CERT Civis.Net

Vulnerability Name:

CVE-2015-1913 (CCN-101855)

Assigned:

2015-06-18

Published:

2015-06-18

Updated:

2016-11-30

Summary:

Rational Test Control Panel in IBM Rational Test Workbench and Rational Test Virtualization Server 8.0.0.x before 8.0.0.5, 8.0.1.x before 8.0.1.6, 8.5.0.x before 8.5.0.4, 8.5.1.x before 8.5.1.5, 8.6.0.x before 8.6.0.4, and 8.7.0.x before 8.7.0.2 uses the MD5 algorithm for password hashing, which makes it easier for remote attackers to bypass authentication via unspecified vectors.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2015-1913

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21959298

Source: BID
Type: UNKNOWN
75307

Source: XF
Type: UNKNOWN
ibm-rit-cve20151913-weak-sec(101855)

Source: CCN
Type: IBM Security Bulletin 1959298
Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server uses an insecure hashing scheme for handling user passwords (CVE-2015-1913)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:rational_test_virtualization_server:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.5.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.6.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.6.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_virtualization_server:8.7.0.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:ibm:rational_test_workbench:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.7.0.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:rational_test_workbench:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.7.0:*:*:*:*:*:*:*

AND

cpe:/a:ibm:rational_test_workbench:8.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.5.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.6.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_test_workbench:8.7.0.1:*:*:*:*:*:*:*

Denotes that component is vulnerable