IBM Eclipse Help System Multiple Security Vulnerabilities
BID:53884
Info
IBM Eclipse Help System Multiple Security Vulnerabilities
| Bugtraq ID: | 53884 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-2159 CVE-2012-2161 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 08 2012 12:00AM |
| Updated: | Sep 01 2014 01:23AM |
| Credit: | Infineon |
| Vulnerable: |
IBM WebSphere Commerce 7.0 IBM WebSphere Commerce 6.0 IBM Tivoli Storage Manager Fastback 6.1.1.0 IBM Tivoli Storage Manager Fastback 6.1.0.0 IBM Tivoli Service Request Manager 7.2 IBM Tivoli Service Request Manager 7.1 IBM Tivoli Asset Management for IT 7.2 IBM Tivoli Asset Management for IT 7.1 IBM Tivoli Asset Management for IT 6.2 IBM SPSS Data Collection 6.0.1 IBM SPSS Data Collection 6.0 IBM Rational ClearQuest 7.1 IBM Maximo Service Desk 6.2 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management Essentials 6.2 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Installation Manager 1.3 IBM Installation Manager 1.5 IBM Installation Manager 0 IBM InfoSphere Information Server 8.5 IBM InfoSphere Information Server 8.1 IBM IBM Rational ClearQuest 7.1.1 IBM IBM Rational ClearQuest 8.0 IBM DB2 Information Center 9 IBM Change and Configuration Management Database 7.2 IBM Change and Configuration Management Database 7.1 |
| Not Vulnerable: | |
Discussion
IBM Eclipse Help System Multiple Security Vulnerabilities
The IBM Eclipse Help System is prone to the following security vulnerabilities:
1. An open-redirection weakness.
2. A cross-site scripting vulnerability.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
IBM Eclipse Help System 3.4.3 is vulnerable; other versions may also be affected.
The IBM Eclipse Help System is prone to the following security vulnerabilities:
1. An open-redirection weakness.
2. A cross-site scripting vulnerability.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
IBM Eclipse Help System 3.4.3 is vulnerable; other versions may also be affected.
Exploit / POC
IBM Eclipse Help System Multiple Security Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting victim into following a malicious URI.
An attacker can exploit these issues by enticing an unsuspecting victim into following a malicious URI.
Solution / Fix
IBM Eclipse Help System Multiple Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
IBM Eclipse Help System Multiple Security Vulnerabilities
References:
References:
- IBM Homepage (IBM)
- Tivoli Storage Manager FastBack (IBM)