IBM WebSphere Application Server Local Information Disclosure Vulnerability

Bugtraq ID:	36458
Class:	Design Error
CVE:	CVE-2009-2743
Remote:	No
Local:	Yes
Published:	Sep 18 2009 12:00AM
Updated:	Dec 16 2009 08:03PM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0
Not Vulnerable:	IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 6.1.0.27

IBM WebSphere Application Server Local Information Disclosure Vulnerability

IBM WebSphere Application Server (WAS) is prone to an information-disclosure vulnerability.

Exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks.

Versions prior to WAS 6.1.0.27 and 7.0.7 are vulnerable.

IBM WebSphere Application Server Local Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server Local Information Disclosure Vulnerability

Solution:
IBM has released fixes. Please see the vendor reference for details.

IBM WebSphere Application Server Local Information Disclosure Vulnerability

References:

• IBM - PK86137; 7.0.0.5: sensitive information printed in FFDC log (IBM)
  
• IBM WebSphere Application Server wsadmin JAAS-J2C Information Disclosure (IBM)
  
• IBM Websphere Homepage (IBM)