Test ID:	1.3.6.1.4.1.25623.1.0.801862
Category:	Web Servers
Title:	IBM WebSphere Application Server 6.1.x < 6.1.0.35, 7.x < 7.0.0.15 Multiple Vulnerabilities
Summary:	IBM WebSphere Application Server is prone to multiple; vulnerabilities.
Description:	Summary: IBM WebSphere Application Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - The Administrative Scripting Tools component, when tracing is enabled, places wsadmin command parameters into the 'wsadmin.traceout' and 'trace.log' files, which allows local users to obtain potentially sensitive information by reading these files. - A double free error which allows remote backend IIOP servers to cause a denial of service by rejecting IIOP requests at opportunistic time instants. - The Security component allows remote authenticated users to cause a denial of service by using a Lightweight Third-Party Authentication (LTPA) token for authentication. - The Security component does not properly delete AuthCache entries upon a logout, which might allow remote attackers to access the server by leveraging an unattended workstation. Vulnerability Impact: Successful exploitation will let attackers to obtain sensitive information or cause a denial of service. Affected Software/OS: IBM WebSphere Application Server version 6.1.x prior to 6.1.0.35 and 7.x prior to 7.0.0.15. Solution: Update to version 6.1.0.35, 7.0.0.15 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1310 AIX APAR: PM18736 http://www-01.ibm.com/support/docview.wss?uid=swg1PM18736 Common Vulnerability Exposure (CVE) ID: CVE-2011-1313 AIX APAR: PM17170 http://www-01.ibm.com/support/docview.wss?uid=swg1PM17170 Common Vulnerability Exposure (CVE) ID: CVE-2011-1319 AIX APAR: PM18644 http://www-01.ibm.com/support/docview.wss?uid=swg1PM18644 Common Vulnerability Exposure (CVE) ID: CVE-2011-1320 AIX APAR: PM21536 http://www-01.ibm.com/support/docview.wss?uid=swg1PM21536
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.