Otkriven je sigurnosni nedostatak u radu IBM WebSphere Application poslužitelja. Moguće ga je iskoristiti udaljeno, za zaobilaženje pojedinih sigurnosnih ograničenja.

Secunia Advisory SA46001
IBM WebSphere Application Server SAML Signature Wrapping Vulnerability
Release Date 	2011-09-13

Criticality level 	Moderately criticalModerately critical
Impact 	Security Bypass
Where 	From remote
Authentication level 	Available in Customer Area
  	 
Report reliability 	Available in Customer Area
Solution Status 	Vendor Patch
  	 
Systems affected 	Available in Customer Area
Approve distribution 	Available in Customer Area
  	 
Software:	
	IBM WebSphere Application Server 7.0.x

Secunia CVSS Score 	Available in Customer Area
CVE Reference(s) 	No CVE references.

	   	

Description

A vulnerability has been reported in IBM WebSphere Application Server, which can be exploited by malicious people to bypass certain security features.

The vulnerability is caused due to the SAML library not properly verifying certain signed tokens, which can be exploited to bypass the verification via "wrapping attacks".

This may be related to:
SA45385

Solution
Apply APAR PM43254 or update to version 7.0.0.19.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
IBM (PM43254):
http://www.ibm.com/support/docview.wss?uid=swg27014463