Security Alerts

Secunia

Community Login

VIM Login

Partner Login

Overview

Advisories

Research

Forums

Create Profile

Our Commitment

Database

Advisories by Product

Advisories by Vendor

Terminology

Report Vulnerability

Insecure Library Loading

Secunia Advisory SA38338

IBM WebSphere Application Server TLS Session Renegotiation Plaintext Injection

Secunia Advisory

SA38338

Get alerted and manage the vulnerability life cycle

Release Date

2010-01-25

Last Update

2010-04-26

Popularity

2,846 views

Comments

0 comments

Criticality level

Less critical

Impact

Manipulation of data

Where

From remote

Authentication level

Available in Customer Area

Report reliability

Available in Customer Area

Solution Status

Vendor Workaround

Systems affected

Available in Customer Area

Approve distribution

Available in Customer Area

Software:

IBM WebSphere Application Server 6.0.x

IBM WebSphere Application Server 6.1.x

Secunia CVSS Score

Available in Customer Area

CVE Reference(s)

CVE-2009-3555 CVSS available in Customer Area

Description

A vulnerability has been reported in IBM WebSphere Application Server, which can be exploited by malicious people to manipulate certain data.

For more information:
SA37291

Solution
Apply interim APARs to disable the TLS handshake renegotiation (please see the vendor's advisories for details).
Changelog
Further details available in Customer Area

Original Advisory
IBM (PM04534, PM04544, PM04483, PM04482, PM06400, PM04626, PM04394)
http://www-01.ibm.com/support/docview.wss?uid=swg24025718
http://www-01.ibm.com/support/docview.wss?uid=swg24025719
http://www-01.ibm.com/support/docview.wss?uid=swg24025742
http://www-01.ibm.com/support/docview.wss?uid=swg24025746
http://www-01.ibm.com/support/docview.wss?uid=swg24025836
http://www-01.ibm.com/support/docview.wss?uid=swg21413714
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: IBM WebSphere Application Server TLS Session Renegotiation Plaintext Injection

No posts yet

Secunia Advisory SA38338

IBM WebSphere Application Server TLS Session Renegotiation Plaintext Injection

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?