IBM Cognos Express Hardcoded Credentials Security Bypass Vulnerability

Bugtraq ID:	38084
Class:	Design Error
CVE:	CVE-2010-0557
Remote:	Yes
Local:	No
Published:	Feb 03 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	IBM
Vulnerable:	IBM Cognos Express 9.0
Not Vulnerable:

IBM Cognos Express Hardcoded Credentials Security Bypass Vulnerability

IBM Cognos Express is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass security restrictions and execute arbitrary code with the privileges of the vulnerable application.

This issue affects IBM Cognos Express 9.0.

IBM Cognos Express Hardcoded Credentials Security Bypass Vulnerability

Attackers can use standard tools to exploit this issue.

IBM Cognos Express Hardcoded Credentials Security Bypass Vulnerability

Solution:
The vendor has released an advisory with a solution. Please see the references for details.

IBM Cognos Express Hardcoded Credentials Security Bypass Vulnerability

References:

• Cognos Express (IBM)
  
• IBM Cognos Express allows access using hard coded credentials to Tomcat Manager (IBM)
  
• ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerabili (Zero Day Initiative)
  
• ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerabili (ZDI Disclosures )
  
• IBM Cognos Express allows access to Tomcat Manager using hard coded credentials (IBM)