IBM Tivoli Access Manager for e-business Directory Traversal Vulnerability

Bugtraq ID:	45582
Class:	Input Validation Error
CVE:	CVE-2010-4622
Remote:	Yes
Local:	No
Published:	Dec 24 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Tivoli Access Manager for e-business 6.1.1
Not Vulnerable:

IBM Tivoli Access Manager for e-business Directory Traversal Vulnerability

IBM Tivoli Access Manager for e-business is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

IBM Tivoli Access Manager for e-business 6.1.1 is vulnerable.

IBM Tivoli Access Manager for e-business Directory Traversal Vulnerability

An attacker can exploit this issue with a web browser.

The following example URI is available:

http://www.example.com/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd

IBM Tivoli Access Manager for e-business Directory Traversal Vulnerability

Solution:
The vendor has released a patch. Please see the references for more information.

IBM Tivoli Access Manager for e-business Directory Traversal Vulnerability

References:

• IBM Tivoli Access Manager for e-business (IBM)
  
• Tivoli Access Manager for e-Business WebSEAL, Patch 6.1.1-TIV-AWS-FP0001 (IBM)