BID:47831

IBM WebSphere Application Server WS-Security XML Encryption Weakness

Info

IBM WebSphere Application Server WS-Security XML Encryption Weakness

Bugtraq ID:	47831
Class:	Design Error
CVE:	CVE-2011-1209
Remote:	Yes
Local:	No
Published:	Apr 15 2011 12:00AM
Updated:	Mar 19 2015 09:41AM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0 .9 IBM Websphere Application Server 7.0 .8 IBM Websphere Application Server 7.0 .2 IBM Websphere Application Server 7.0 .13 IBM Websphere Application Server 7.0 .12 IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 6.1.2 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .33 IBM Websphere Application Server 6.1 .32 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 8.0.0.4 IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 7.0.0.6 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.4 IBM Websphere Application Server 7.0.0.15 IBM Websphere Application Server 7.0.0.14 IBM Websphere Application Server 7.0.0.13 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1.0.35 IBM Websphere Application Server 6.1.0.34 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.1.0.31 IBM Websphere Application Server 6.1.0.29 IBM Websphere Application Server 6.1.0.27 IBM Websphere Application Server 6.1

Not Vulnerable:	IBM Websphere Application Server 7.0.0.17 IBM Websphere Application Server 6.1.0.39

Discussion

IBM WebSphere Application Server WS-Security XML Encryption Weakness

IBM WebSphere Application Server (WAS) is prone to a security weakness because the application uses a weak WS-Security XML encryption algorithm.

Successful exploits may aid attackers in obtaining plaintext data from JAX-RPC or JAX-WS requests, which may lead to other attacks.

Versions prior to WebSphere Application Server 6.1.0.39 and 7.0.0.17 are vulnerable.

Exploit / POC

IBM WebSphere Application Server WS-Security XML Encryption Weakness

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

IBM WebSphere Application Server WS-Security XML Encryption Weakness

Solution:
Updates are available; please see the references for more information.

References

IBM WebSphere Application Server WS-Security XML Encryption Weakness

References: