IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability

Bugtraq ID:	32577
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 02 2008 12:00AM
Updated:	Dec 03 2008 05:31PM
Credit:	This issue was disclosed by the vendor
Vulnerable:	IBM Rational ClearQuest 7.0.1 .1 IBM Rational ClearQuest 7.0.1 IBM Rational ClearQuest 7.0 .2 IBM Rational ClearQuest 7.0 .1 IBM Rational ClearQuest 7.0
Not Vulnerable:	IBM Rational ClearQuest 7.0.1 3 IBM Rational ClearQuest 7.0 4

IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability

IBM Rational ClearQuest Maintenance Tool is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may allow them to perform unauthorized modifications to computers on the affected network.

Versions prior to ClearQuest 7.0.0.4 and 7.0.1.3 are vulnerable.

IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability

An attacker can use readily available utilities to exploit this issue.

IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability

References:

• PK30938: PASSWORD REVEALER UTILITIES DISPLAY DATABASE PASSWORDS IN CLEARQUEST (IBM)
  
• Rational ClearQuest Homepage (IBM)