IBM Cúram Social Program Management CVE-2014-3012 HTTP Response Splitting Vulnerability

Bugtraq ID:	68008
Class:	Input Validation Error
CVE:	CVE-2014-3012
Remote:	Yes
Local:	No
Published:	Jun 09 2014 12:00AM
Updated:	Jun 09 2014 12:00AM
Credit:	IBM
Vulnerable:	IBM Cúram Social Program Management 6.0.5 IBM Cúram Social Program Management 6.0.4 IBM Cúram Social Program Management 5.2.4 IBM Cúram Social Program Management 5.2.1 IBM Cúram Social Program Management 6.0.5.4 IBM Cúram Social Program Management 6.0.5.3 IBM Cúram Social Program Management 6.0.5.2 IBM Cúram Social Program Management 6.0.4.5 IBM Cúram Social Program Management 6.0.4.4
Not Vulnerable:

IBM Cúram Social Program Management CVE-2014-3012 HTTP Response Splitting Vulnerability

IBM Cúram Social Program Management is prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

IBM Cúram Social Program Management CVE-2014-3012 HTTP Response Splitting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Cúram Social Program Management CVE-2014-3012 HTTP Response Splitting Vulnerability

References:

• Curam Social Program Management Homepage (IBM)
  
• Cúram is vulnerable to CRLF Injection attack (CVE-2014-3012) (IBM)