IBM InfoSphere Optim Data Growth for Oracle E-Business Suite SSL Certificate Spoofing Vulnerability

Bugtraq ID:	60217
Class:	Design Error
CVE:	CVE-2013-2953
Remote:	Yes
Local:	No
Published:	May 14 2013 12:00AM
Updated:	May 14 2013 12:00AM
Credit:	IBM
Vulnerable:	IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 9.1 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 8.1 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 7.1.2 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 7.1.1 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 7.1.0 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 6.1 IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 6.0
Not Vulnerable:	IBM InfoSphere Optim Data Growth Solution for Oracle E-Business Suit 9.1.0.3

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite SSL Certificate Spoofing Vulnerability

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite is prone to a security vulnerability that may allow attackers to conduct spoofing attacks.

Attackers can exploit this issue to spoof a valid server and conduct man-in-the-middle attacks. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site.

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.0 through 9.1 are affected.

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite SSL Certificate Spoofing Vulnerability

Attackers can use readily available tools to exploit this issue.

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite SSL Certificate Spoofing Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite SSL Certificate Spoofing Vulnerability

References:

• InfoSphere Optim Homepage (IBM)
  
• Security Bulletin: Multiple vulnerabilities in IBM InfoSphere Optim Data Growth (IBM)