IBM Tivoli Access Manager for e-business Remote Denial Of Service Vulnerability

Bugtraq ID:	32461
Class:	Unknown
CVE:	CVE-2008-5257
Remote:	Yes
Local:	No
Published:	Nov 18 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	This issue was reported by the vendor.
Vulnerable:	IBM Tivoli Access Manager for e-business 6.0 .17
Not Vulnerable:

IBM Tivoli Access Manager for e-business Remote Denial Of Service Vulnerability

IBM Tivoli Access Manager for e-business is prone to a remote denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the service to crash or hang, denying service to legitimate users.

IBM Tivoli Access Manager for e-business 6.0.0.17 is vulnerable; other versions may also be affected.

IBM Tivoli Access Manager for e-business Remote Denial Of Service Vulnerability

An attacker can use a McAfee vulnerability scanner to trigger this issue.

IBM Tivoli Access Manager for e-business Remote Denial Of Service Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


IBM Tivoli Access Manager for e-business 6.0 .17

• IBM Patch 6.0.0-TIV-AWS-FP0022
  Tivoli Access Manager for e-Business WebSEAL, Patch 6.0.0-TIV-AWS-FP0022

IBM Tivoli Access Manager for e-business Remote Denial Of Service Vulnerability

References:

• IBM Tivoli Access Manager for e-business (IBM)
  
• IZ28611: WEBSEAL 6.0.0.17 / WIN3K USER.DMP (IBM)
  
• IZ37270: WEBSEAL FAILING (CRASH?) DURING VULNERABILITY SCAN FROM MCAFEE (IBM)