IBM InfoSphere Optim Performance Manager CVE-2014-6154 Unspecified Directory Traversal Vulnerability

Bugtraq ID:	72870
Class:	Input Validation Error
CVE:	CVE-2014-6154
Remote:	Yes
Local:	No
Published:	Mar 03 2015 12:00AM
Updated:	Mar 03 2015 12:00AM
Credit:	Adrian Pastor from MINERVA Information Security
Vulnerable:	IBM InfoSphere Optim Performance Manager 5.3.1 IBM InfoSphere Optim Performance Manager 5.3 IBM InfoSphere Optim Performance Manager 5.2 IBM InfoSphere Optim Performance Manager 5.1.1.1 IBM InfoSphere Optim Performance Manager 5.1.1.0 IBM InfoSphere Optim Performance Manager 5.1.0 IBM InfoSphere Optim Performance Manager 4.1.1 IBM InfoSphere Optim Performance Manager 4.1.0.1 IBM InfoSphere Optim Performance Manager 4.1
Not Vulnerable:

IBM InfoSphere Optim Performance Manager CVE-2014-6154 Unspecified Directory Traversal Vulnerability

IBM InfoSphere Optim Performance Manager is prone to an unspecified directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. This may aid in further attacks.

IBM InfoSphere Optim Performance Manager CVE-2014-6154 Unspecified Directory Traversal Vulnerability

An attacker can exploit this issue using a web browser.

IBM InfoSphere Optim Performance Manager CVE-2014-6154 Unspecified Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM InfoSphere Optim Performance Manager CVE-2014-6154 Unspecified Directory Traversal Vulnerability

References:

• IBM Homepage (IBM)
  
• InfoSphere Optim Performance Manager for DB2 for Linux, UNIX, and Windows (IBM)
  
• Security Bulletin: Security vulnerability affecting IBM InfoSphere Optim Perform (IBM)