Actu
Vigil@nce - IBM WebSphere AS: privilege elevation with PM44303
September 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
When PM44303 is installed on IBM WebSphere Application Server, a
local attacker can access to administration features.
Impacted products: WebSphere AS
Severity: 2/4
Creation date: 30/08/2012
DESCRIPTION OF THE VULNERABILITY
The LTPA (Lightweight Third-Party Authentication) technology is
used to process the authentication of IBM products.
The APAR PM44303 corrects an error in the processing of the LTPA
cookie. However, with this APAR, user’s privileges are not checked.
When PM44303 is installed on IBM WebSphere Application Server, a
local attacker can therefore access to administration features.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/IBM-WebSphere-AS-privilege-elevation-with-PM44303-11907
