Timothy D. Morgan has reported a vulnerability in IBM Tivoli Access Manager for e-business, which can be exploited by malicious users to disclose potentially sensitive information.

Input passed to the "filename" parameter in pkmslogout isn't properly sanitised before being used to retrieve the page template. This can be exploited to retrieve arbitrary files accessible by the web server via directory traversal attacks.

The vulnerability has been reported in version 5.1.0 and 6.0. Prior versions may also be affected.

Solution
Apply patch.
Further details available to Secunia VIM customers

Provided and/or discovered by
Timothy D. Morgan, Virtual Security Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg21228486
http://www-1.ibm.com/support/docview.wss?uid=swg24011562
http://www-1.ibm.com/support/docview.wss?uid=swg24011561

Virtual Security Research:
http://www.vsecurity.com/bulletins/advisories/2006/tam-file-retrieval.txt

Deep Links
Links available to Secunia VIM customers