漏洞类别：Local
漏洞等级： 
漏洞信息
IBM WebSphere Application Server is designed to facilitate the creation of various enterprise Web applications.
IBM WebSphere Application Server has multiple vulnerabilities in the HTTP Server.
Affected Versions:
IBM WebSphere Application Server :
Liberty
Version 9.0
Version 8.5.5
Version 8.5
Version 8.0
Version 7.0
QID Detection Logic (Unauthenticated):
This QID matches vulnerable versions in the response it receives by sending a HTTP GET request to target or retrieving by the banner information via the GIOP protocol.
QID Detection Logic (Authenticated):
Operating Systems: Windows
The QID checks if the file %ProgramFiles%\IBM\WebSphere\AppServer\bin\WASService.exe exists on the target or not.
The QID checks the file %programfiles%\IBM\WebSphere\AppServer\properties\version\WAS.product to get the version of IBM WebSphere Application Server
The QID checks if Interim fix PI82481 is applied on the vulnerable versions of IBM WebSphere Application Server -
This QID checks for the file
The following Versions and Interim Fixes checked swg21992315:
WebSphere Application Server version 9.0.0.0 through 9.0.0.4
WebSphere Application Server version 8.5.0.0 through 8.5.5.11
WebSphere Application Server version 8.0.0.0 through 8.0.0.13
WebSphere Application Server version 7.0.0.0 through 7.0.0.43
Interim Fix - PI82481
漏洞危害
Successful exploitation of the vulnerabilities will allow remote attackers to leak sensitive information, cause a denial of service and bypass security restrictions.
解决方案
The vendor has released a fix to resolve the issue, please refer to Recommended fixes for WebSphere Application Serverfor more information.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
0daybank
文章评论