IBM LTPA STS Module Threads Security Vulnerability

Bugtraq ID:	49244
Class:	Access Validation Error
CVE:	CVE-2011-3138
Remote:	Yes
Local:	No
Published:	Aug 18 2011 12:00AM
Updated:	Aug 18 2011 12:00AM
Credit:	IBM
Vulnerable:	IBM Tivoli Federated Identity Manager Business Gateway 6.2 IBM Tivoli Federated Identity Manager 6.2
Not Vulnerable:	IBM Tivoli Federated Identity Manager Business Gateway 6.2.0.9 IBM Tivoli Federated Identity Manager 6.2.0.9

IBM LTPA STS Module Threads Security Vulnerability

IBM LTPA STS is prone to a security vulnerability related to the way it handles threads.

The impact of this issue is currently unknown at the moment; however typical scenario may result in a denial-of-service condition or arbitrary data being overwritten.

The following products are affected:

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 prior to 6.2.0.9
IBM Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 prior to 6.2.0.9

IBM LTPA STS Module Threads Security Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM LTPA STS Module Threads Security Vulnerability

Solution:
Updates are available. Please see the references for more information.

IBM LTPA STS Module Threads Security Vulnerability

References:

• IBM Homepage (IBM)
  
• IV01318: LTPA MODULE PERMITS CONCURRENT ACCESS TO NON THREAD SAFE CLASS (IBM)