IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

Bugtraq ID:	35610
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 08 2009 12:00AM
Updated:	Jul 09 2009 03:56PM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.0.2 .31 IBM Websphere Application Server 6.0.2 .29 IBM Websphere Application Server 6.0.2 .27 IBM Websphere Application Server 6.0.2 .25 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0
Not Vulnerable:

IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

IBM WebSphere Application Server (WAS) is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to gain unauthorized access to the service, which may lead to other attacks.

IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.

IBM WebSphere Application Server JAX-RPC WS-Security Security Bypass Vulnerability

References:

• IBM Websphere Homepage (IBM)
  
• swg21367223 WebSphere Application Server with JAX-RPC WS-Security may improperly (IBM)