IBM Multiple Products SSL Certificate Validation Security Bypass Vulnerability
BID:57014
Info
IBM Multiple Products SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 57014 |
| Class: | Design Error |
| CVE: |
CVE-2012-0738 CVE-2012-0741 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 20 2012 12:00AM |
| Updated: | Dec 20 2012 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
IBM Rational Policy Tester 8.5.0.1 |
| Not Vulnerable: | |
Discussion
IBM Multiple Products SSL Certificate Validation Security Bypass Vulnerability
IBM Rational Policy Tester and IBM Rational AppScan Enterprise are prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Attackers can exploit this issue to display incorrect SSL certificates. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site.
IBM Rational Policy Tester versions prior to 8.5.0.3 and IBM Security AppScan Enterprise versions prior to 8.6.0.2 are vulnerable.
IBM Rational Policy Tester and IBM Rational AppScan Enterprise are prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Attackers can exploit this issue to display incorrect SSL certificates. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site.
IBM Rational Policy Tester versions prior to 8.5.0.3 and IBM Security AppScan Enterprise versions prior to 8.6.0.2 are vulnerable.
Exploit / POC
IBM Multiple Products SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
References
IBM Multiple Products SSL Certificate Validation Security Bypass Vulnerability
References:
References: