BID:35594

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

Info

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

Bugtraq ID:	35594
Class:	Design Error
CVE:	CVE-2009-0903
Remote:	Yes
Local:	No
Published:	Jun 16 2009 12:00AM
Updated:	Jul 07 2009 10:56PM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0

Not Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 6.1 .25

Discussion

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

IBM WebSphere Application Server (WAS) is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass certain security restrictions, which may lead to other attacks.

The following versions are affected:

WAS 7.0 (prior to 7.0.0.3)
WAS 6.1.0 (prior to 6.1.0.25)

Exploit / POC

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

Solution:
The vendor has released a fix. Please see the references for details.

References

IBM WebSphere Application Server JAX-WS Application Security Bypass Vulnerability

References: