Security Bulletin: Tivoli Federated Identity Manager - Passwords exposed in trace files (CVE-2012-3310)

Content

VULNERABILITY DETAILS

CVE ID: CVE-2012-3310


DESCRIPTION:
The four logging configurations described below result in the TFIM trace files containing passwords that are either in clear text or obfuscated in a manner that the password can be derived. In all cases, accessing the configuration of the system in order to enable the logging, as well as accessing the resulting trace files, requires elevated privileges.

1) ALIAS SERVICE SETTINGS
Enabling the "all" TFIM log trace setting results in the Alias Service Settings LDAP "Bind Password" to appear in clear text in the resulting log files upon execution of SAML 2.0 Single Sign On flow.

2) VIEWING KEYSTORES
Enabling the "all" TFIM log trace setting results in obfuscated keystore passwords being logged upon "View Keys" execution in TFIM configuration.

3) ARTIFACT FEDERATION SINGLE SIGN ON WITH BASIC AUTHENTICATION
Enabling the "all" TFIM log trace setting results in the client Basic Authentication password being logged in clear text upon execution of SAML 2.0 Federation SSO flow using HTTP-Artifact.

4) STS MODULE USERNAMETOKEN
Enabling the "all" TFIM log trace setting results in the end-user supplied password being logged in clear text when issuing the UsernameToken.

An attack does not require local network access, but it does it require authentication and specialized knowledge and techniques. An exploit will not impact accessibility of system resources or the integrity of information, but the confidentiality of some of the data managed by TFIM could be compromised.



CVSS:
CVSS Base Score: 3.5
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N)
Details: https://exchange.xforce.ibmcloud.com/vulnerabilities/77695


AFFECTED PLATFORMS
All versions of TFIM before 6.2.2 are affected, including those no longer supported.

TFIM versions 6.1.1, 6.2.0, 6.2.1


REMEDIATION:

Vendor Fixes: Patches and installation instructions are provided at the URLs listed below.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.