IBM WebSphere Application Server Denial of Service And Security Bypass Vulnerabilities

Bugtraq ID:	31839
Class:	Unknown
CVE:	CVE-2008-4678 CVE-2008-4679 CVE-2008-4111
Remote:	Yes
Local:	No
Published:	Oct 20 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 6.0.2 .29 IBM Websphere Application Server 6.0.2 .25 IBM Websphere Application Server 6.0.2 .24 IBM Websphere Application Server 6.0.2 .23 IBM Websphere Application Server 6.0.2 .22 IBM Websphere Application Server 6.0.2 .21 IBM Websphere Application Server 6.0.2 .17 IBM Websphere Application Server 6.0.2 .15 IBM Websphere Application Server 6.0.2 .13 IBM Websphere Application Server 6.0.2 .11 IBM Websphere Application Server 6.0.2 .1 IBM Websphere Application Server 6.0.2.19
Not Vulnerable:	IBM Websphere Application Server 6.0.2 .31

IBM WebSphere Application Server Denial of Service And Security Bypass Vulnerabilities

IBM WebSphere Application Server (WAS) is prone to multiple vulnerabilities, including a denial-of-service issue and a security-bypass issue.

Successful exploits may allow attackers to bypass certain security restrictions or to hang the server, causing a denial-of-service condition.

These issues affect versions prior to WAS 6.0.2.31.

IBM WebSphere Application Server Denial of Service And Security Bypass Vulnerabilities

Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server Denial of Service And Security Bypass Vulnerabilities

Solution:
The vendor has relased an advisory and fixes. Please see the references for more information.

IBM WebSphere Application Server Denial of Service And Security Bypass Vulnerabilities

References:

• Fix list for WebSphere Application Server Version 6.0.2 (IBM)
  
• IBM Websphere Homepage (IBM)