Some vulnerabilities and a security issue have been reported in WebSphere Application Server. Some of which have an unknown impact, others can be exploited by malicious, local users to read or manipulate certain files, and by malicious people to conduct cross-site scripting attacks, conduct spoofing attacks, or bypass certain security restrictions.

1) Input passed via the URL to /ibm/console/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

This is related to vulnerability #1 in:
SA34131

2) An error exists due to interim fixes that replace existing files or create new files incorrectly setting permission to 777.

3) An unspecified error can cause the JAX-RPC WS-Security runtime to incorrectly validate a UsernameToken.

4) A security issue is caused due to the Application Server using the "HMACOutputLength" parameter of the "SignatureMethod" element without verifying if the amount of signature bits is reasonably secure for the underlying HMAC algorithm. This can be exploited to conduct spoofing attacks by limiting the checked signature bits to an amount that is easy to forge.

The vulnerabilities and the security issue are reported in WebSphere Application Server V7.0.

Solution
Apply Fix Pack 3 (7.0.0.3):
Further details available in Customer Area

Provided and/or discovered by
1) Digital Security Research Group
2-4) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
IBM (PK75992):
http://www-01.ibm.com/support/docview.wss?uid=swg21367223

IBM (PK77505, PK77590):
http://www-01.ibm.com/support/docview.wss?uid=swg1PK82988

IBM (PK75992, PK80596):
http://www-01.ibm.com/support/docview.wss?uid=swg27014463

IBM (PK80596 and PK80627):
http://www-01.ibm.com/support/docview.wss?uid=swg21384925

Digital Security Research Group:
http://dsecrg.com/pages/vul/show.php?id=113

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area