IBM WebSphere Partner Gateway RNIF Document Security Bypass Vulnerability

Bugtraq ID:	33839
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2009 12:00AM
Updated:	Feb 20 2009 03:47PM
Credit:	The vendor reported this issue.
Vulnerable:	IBM WebSphere Partner Gateway 6.0 .7 IBM WebSphere Partner Gateway 6.0 .6 IBM WebSphere Partner Gateway 6.0 .5 IBM WebSphere Partner Gateway 6.0 .4 IBM WebSphere Partner Gateway 6.0 .3 IBM WebSphere Partner Gateway 6.0 .2 IBM WebSphere Partner Gateway 6.0 .1 IBM WebSphere Partner Gateway 6.0
Not Vulnerable:

IBM WebSphere Partner Gateway RNIF Document Security Bypass Vulnerability

IBM WebSphere Partner Gateway is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to pass malicious RosettaNet Implementation Framework (RNIF) documents to a back-end application.

IBM WebSphere Partner Gateway RNIF Document Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Partner Gateway RNIF Document Security Bypass Vulnerability

Solution:
The vendor has released a fix. Please see the references for more information.


IBM WebSphere Partner Gateway 6.0 .7

• IBM JR31231
  http://www.ibm.com/eserver/support/fixes/fixcentral/swg/quickorder?fix es=6.0.0.7-WPG-Advanced-Enterprise-JR31231&productid=WebSphere%20Partn er%20Gateway%20Advanced%20Edition&brandid=5

IBM WebSphere Partner Gateway RNIF Document Security Bypass Vulnerability

References:

• WebSphere Partner Gateway (IBM)
  
• swg21330341 Signature Verification Problem with WebSphere Partner Gateway 6.0 RN (IBM)