Security Bulletin: "Local Access Only" authentication type does not prevent unauthenticated remote access to Help Server Administration in ClearQuest (CVE-2014-3106)

Summary

“Local Access Only” authentication type does not prevent unauthenticated remote access to Help Server Administration.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID: CVE-2014-3106

**Description:**IBM Rational ClearQuest allows a remote unauthenticated attacker bypass security restrictions set by the “Local Access Only” ACL. ClearQuest introduced a new Help system since 7.1.2.02 in 2011, but the “Local Access Only” authentication type doesn’t work. This would allow the attacker to view files they might not otherwise have access to.

CVSS Base Score: 5.0 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94313&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

ClearQuest version

| Status
—|—
8.0.1 through 8.0.1.4| Affected
8.0 through 8.0.0.11| Affected
7.1.2 through 7.1.2.14| Affected
7.1.0.x, 7.1.1.x (all versions and fix packs)| Not Affected

Remediation/Fixes

Upgrade to one of the following releases:

Workarounds and Mitigations

None