Security Bulletin: Tivoli Federated Identity Manager and Tivoli Federated Identity Manager Business Gateway redirect to an insufficiently validated URL (CVE-2013-5431)

Content

VULNERABILITY DETAILS:

CVE ID:
CVE-2013-5431

DESCRIPTION:

Under certain conditions, Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) could send a redirect to a URL provided by an external client in an HTTP request without performing sufficient validation of the URL. This could allow an attacker to trick a user into communicating with a malicious site by means of a specially crafted HTTP request.

The attack requires network access and some degree of specialized knowledge or techniques, no authentication is required. An exploit could impact the confidentiality of data, but the integrity and the availability of the system are not compromised.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87616 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)


AFFECTED PLATFORMS:
Tivoli Federated Identity Manager (TFIM): v6.1.1, 6.2.0, 6.2.1, 6.2.2
Tivoli Federated Identity Manager Business Gateway (TFIMBG): v6.1.1, 6.2.0, 6.2.1, 6.2.2

REMEDIATION:

The recommended solution is to apply the fix for each named product as soon as practical. Please see below for information about the fixes available.