Security Bulletin: Multiple vulnerabilities addressed in IBM Security Access Manager

Vulnerability Details

The following vulnerabilities affect both IBM Security Access Manager for Mobile and IBM Security Access Manager for Web.


CVE-ID: CVE-2014-6080

DESCRIPTION: IBM Security Access Manager is vulnerable to an SQL injection attack in which a remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

The vulnerability can be accessed from a remote network, is of medium complexity and requires authentication. A successful exploit could not compromise the confidentiality of the system, could partially compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95767 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)



CVE-ID: CVE-2014-6078

DESCRIPTION: IBM Security Access Manager allows multiple failed login requests without locking out the user. This could allow an attacker to guess the admin credentials over a period of time through a brute force attack.

The vulnerability can be accessed from a remote network, is of low complexity and does not require authentication. A successful exploit could not compromise the confidentiality of the system, could partially compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 5.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95762 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)



CVE-ID: CVE-2014-6076

DESCRIPTION: IBM Security Access Manager fails to sanitize certain user actions that could allow a remote attacker to hijack the clicking action of another user. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch other client-side browser attacks.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could not compromise the confidentiality of the system, could partially compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95729 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)



CVE-ID: CVE-2014-6077

DESCRIPTION: IBM Security Access Manager fails to properly validate certain user-supplied data. This could enable a cross-site request forgery attack. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request without the user's knowledge. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could not compromise the confidentiality of the system, could partially compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95730 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)



CVE-ID: CVE-2014-6086

DESCRIPTION: Under certain conditions, IBM Security Access Manager can, if requested to do so by the user, use HTTP rather than HTTPS to communicate sensitive data, resulting in unencrypted traffic being transmitted which can be stolen using man in the middle techniques.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could partially compromise the confidentiality of the system, could not compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95813 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)



CVE-ID: CVE-2014-6083

DESCRIPTION: IBM Security Access Manager does not prevent certain cookies being sent by client systems across an unencrypted HTTP connection. If the application is accessed via a network with HTTP after one such cookie has been set on the client, an attacker using man-in-the-middle techniques could recover packets for non-encrypted cookies that could potentially contain sensitive session information or credentials.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could partially compromise the confidentiality of the system, could not compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95810 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)



CVE-ID: CVE-2014-6084

DESCRIPTION: IBM Security Access Manager offers weaker than expected encryption in its use of SSL ciphers. This information could be decrypted by an attacker able to intercept traffic using man in the middle techniques.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could partially compromise the confidentiality of the system, could not compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95811 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)



CVE-ID: CVE-2014-6087

DESCRIPTION: IBM Security Access Manager could allow a remote attacker to obtain sensitive information, caused by the use of cipher suites with weak encryption algorithms. An attacker could exploit this vulnerability using network sniffing tools to obtain sensitive information.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could partially compromise the confidentiality of the system, could not compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95813 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)



CVE-ID: CVE-2014-6088

DESCRIPTION: IBM Security Access Manager could allow a remote attacker to obtain sensitive information. If an SSL client running outside the server environment is not able to select a valid cipher for the connection, it could result in the server using a default null cipher. An attacker could exploit this vulnerability to obtain cleartext information over an SSL channel.

The vulnerability can be accessed from a remote network, is of medium complexity and does not require authentication. A successful exploit could partially compromise the confidentiality of the system, could not compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95860 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)



CVE-ID: CVE-2014-6089

DESCRIPTION: IBM Security Access Manager does not properly enforce the destination directory for uploaded files. This could allow a remote attacker to upload files to protected areas of the file system. This could affect the operations of the system.

The vulnerability can be accessed from a remote network, is of low complexity and requires authentication. A successful exploit could not compromise the confidentiality of the system, could partially compromise the integrity of the system and could not compromise the accessibility of the system.

CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95860 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:N)



CVE-ID: CVE-2014-6082

DESCRIPTION: IBM Security Access Manager is vulnerable to a denial of service attack in which a remote authenticated attacker could cause certain components of the administration user interface to be unavailable.

The vulnerability can be accessed from a remote network, is of low complexity and requires authentication. A successful exploit could not compromise the confidentiality of the system, could not compromise the integrity of the system and could partially compromise the accessibility of the system.

CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95809 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)