IBM Rational ClearCase UCM-CQ Information Disclosure Vulnerability

Bugtraq ID:	34483
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 08 2009 12:00AM
Updated:	Apr 13 2009 03:36PM
Credit:	IBM
Vulnerable:	IBM Rational ClearCase 7.0.1.2 IBM Rational ClearCase 7.0
Not Vulnerable:	IBM Rational ClearCase 7.1.0.1 IBM Rational ClearCase 7.0.1.4 IBM Rational ClearCase 7.0.0.5

IBM Rational ClearCase UCM-CQ Information Disclosure Vulnerability

IBM Rational ClearCase is prone to a local information-disclosure vulnerability.

Exploiting this issue may allow a local attacker to obtain sensitive information that may aid in further attacks.

This issue affects IBM Rational ClearCase 7.0.1.2; other versions may also be affected.

IBM Rational ClearCase UCM-CQ Information Disclosure Vulnerability

A local attacker can use readily available tools to exploit this issue.

IBM Rational ClearCase UCM-CQ Information Disclosure Vulnerability

Solution:
IBM has released fixes. Please see the vendor reference for details.

IBM Rational ClearCase UCM-CQ Information Disclosure Vulnerability

References:

• Rational ClearCase Homepage (IBM)
  
• PK75832: UCM-CQ ON LINUX/AIX: USER LOGIN CREDENTIALS IN PLAIN-TEXT BY PS -EF COM (IBM)