Security Bulletin: Multiple vulnerabilities in Product IMS Enterprise Suite SOAP Gateway (CVE-2012-5785, CVE-2013-0483)

Content

Security Bulletin: Multiple vulnerabilities exist in IMS Enterprise Suite SOAP Gateway (CVE-2012-5785, CVE-2013-0483)

SUMMARY: IMS™ Enterprise Suite SOAP Gateway versions 1.1, 2.1, and 2.2 contain security vulnerabilities related to SSL connections, login processes.


VULNERABILITY DETAILS:

CVE ID: CVE-2012-5785

DESCRIPTION:
IBM® IMS Enterprise Suite SOAP Gateway is vulnerable to attackers who might exploit and intercept the SSL connections to steal data sent over any network topology in which a man-in-the-middle attack is deployed.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79830 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE ID: CVE-2013-0483

DESCRIPTION:
The login function in IMS Enterprise Suite SOAP Gateway can be exploited or misused. Login information could be sent unencrypted to the server as clear text, and it is possible for unencrypted information to be stolen. This login function in IMS Enterprise Suite SOAP Gateway has been present but not used by the program and hence has been removed from the product.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81533 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)


AFFECTED PRODUCTS:
IMS Enterprise Suite SOAP Gateway 1.1, 2.1, and 2.2

REMEDIATION:

FIX(ES):

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.