Test ID:	1.3.6.1.4.1.25623.1.0.801861
Category:	Web Servers
Title:	IBM WebSphere Application Server Multiple Vulnerabilities (Mar 2011)
Summary:	IBM WebSphere Application Server is prone to multiple; vulnerabilities.
Description:	Summary: IBM WebSphere Application Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Error in the installer creates a temporary directory for logs with insecure permissions - Input validation error in the IVT application could allow cross-site scripting (XSS) attacks - Error related to trace requests handling in the plug-in component - The Security component, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the ibm-application-bnd.xml file instead of the intended ibm-application-bnd.xmi file allows remote authenticated users to gain privileges - The Service Integration Bus (SIB) messaging engine allows remote attackers to cause a denial of service (DoS) by performing close operations via network connections to a queue manager - Memory leak in the messaging engine allows remote attackers to cause a denial of service (DoS) via network connections associated with a NULL return value from a synchronous JMS receive call - The Session Initiation Protocol (SIP) Proxy in the HTTP Transport component allows remote attackers to cause a denial of service (DoS) by sending many UDP messages - Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component allows remote attackers to cause a denial of service (DoS) by accessing a JSP page of an application that is repeatedly stopped and restarted Vulnerability Impact: Successful exploitation may let attackers to execute arbitrary script code, steal cookie-based authentication credentials, obtain sensitive information and perform unauthorized actions. Affected Software/OS: IBM WebSphere Application Server prior to version 7.0.0.15. Solution: Update to version 7.0.0.15 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1307 AIX APAR: PM20021 http://www-01.ibm.com/support/docview.wss?uid=swg1PM20021 BugTraq ID: 46736 http://www.securityfocus.com/bid/46736 http://www.vupen.com/english/advisories/2011/0564 Common Vulnerability Exposure (CVE) ID: CVE-2011-1308 AIX APAR: PM20393 http://www-01.ibm.com/support/docview.wss?uid=swg1PM20393 XForce ISS Database: was-ivt-xss(65992) https://exchange.xforce.ibmcloud.com/vulnerabilities/65992 Common Vulnerability Exposure (CVE) ID: CVE-2011-1309 AIX APAR: PM22860 http://www-01.ibm.com/support/docview.wss?uid=swg1PM22860 Common Vulnerability Exposure (CVE) ID: CVE-2011-1311 AIX APAR: PM25455 http://www-01.ibm.com/support/docview.wss?uid=swg1PM25455 Common Vulnerability Exposure (CVE) ID: CVE-2011-1314 AIX APAR: PM19834 http://www-01.ibm.com/support/docview.wss?uid=swg1PM19834 Common Vulnerability Exposure (CVE) ID: CVE-2011-1315 AIX APAR: PM23626 http://www-01.ibm.com/support/docview.wss?uid=swg1PM23626 Common Vulnerability Exposure (CVE) ID: CVE-2011-1316 AIX APAR: PM23115 http://www-01.ibm.com/support/docview.wss?uid=swg1PM23115 Common Vulnerability Exposure (CVE) ID: CVE-2011-1318 AIX APAR: PM23029 http://www-01.ibm.com/support/docview.wss?uid=swg1PM23029
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.