IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
BID:64308
Info
IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
| Bugtraq ID: | 64308 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-3042 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 06 2013 12:00AM |
| Updated: | Dec 06 2013 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Rational Software Architect Design Manager 4.0.3 IBM Rational Software Architect Design Manager 4.0.2 IBM Rational Software Architect Design Manager 4.0.1 IBM Rational Software Architect Design Manager 3.0.1 IBM Rational Software Architect Design Manager 3.0 1 IBM Rational Software Architect Design Manager 4.0.4 IBM Rational Software Architect Design Manager 4.0 IBM Rational Software Architect Design Manager 3.0 IBM Rational Rhapsody Design Manager 4.0.4 IBM Rational Rhapsody Design Manager 4.0.3 IBM Rational Rhapsody Design Manager 4.0.2 IBM Rational Rhapsody Design Manager 4.0.1 IBM Rational Rhapsody Design Manager 4.0 IBM Rational Rhapsody Design Manager 3.0.1 IBM Rational Rhapsody Design Manager 3.0.0.1 IBM Rational Rhapsody Design Manager 3.0 |
| Not Vulnerable: |
IBM Rational Software Architect Design Manager 4.0.5 IBM Rational Rhapsody Design Manager 4.0.5 |
Discussion
IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
IBM Rational Software Architect Design Manager and Rhapsody Design Manager are prone to an unspecified local arbitrary file-access vulnerability because they fail to sanitize user-supplied input.
Local attackers can exploit this issue to retrieve arbitrary files using directory-traversal strings. This may lead to further attacks.
The following products are affected:
Rational Software Architect Design Manager versions 3.0, 3.0.0.1, 3.0.1, 4.0, 4.0.1, 4.0.2, 4.0.3 and 4.0.4
Rational Rhapsody Design Manager versions 3.0, 3.0.0.1, 3.0.1, 4.0, 4.0.1, 4.0.2, 4.0.3 and 4.0.4
IBM Rational Software Architect Design Manager and Rhapsody Design Manager are prone to an unspecified local arbitrary file-access vulnerability because they fail to sanitize user-supplied input.
Local attackers can exploit this issue to retrieve arbitrary files using directory-traversal strings. This may lead to further attacks.
The following products are affected:
Rational Software Architect Design Manager versions 3.0, 3.0.0.1, 3.0.1, 4.0, 4.0.1, 4.0.2, 4.0.3 and 4.0.4
Rational Rhapsody Design Manager versions 3.0, 3.0.0.1, 3.0.1, 4.0, 4.0.1, 4.0.2, 4.0.3 and 4.0.4
Exploit / POC
IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
Attackers require local interactive access to exploit this issue.
Attackers require local interactive access to exploit this issue.
Solution / Fix
IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Multiple Products CVE-2013-3042 Unspecified Local Arbitrary File Access Vulnerability
References:
References: