IBM WebSphere Application Server 6.1.x < 6.1.0.35, 7.x < 7.0.0.15 Multiple Vulnerabilities

# SPDX-FileCopyrightText: 2011 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:ibm:websphere_application_server";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.801862");
  script_version("2024-11-26T07:35:52+0000");
  script_tag(name:"last_modification", value:"2024-11-26 07:35:52 +0000 (Tue, 26 Nov 2024)");
  script_tag(name:"creation_date", value:"2011-03-22 08:43:18 +0100 (Tue, 22 Mar 2011)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_cve_id("CVE-2011-1310", "CVE-2011-1313", "CVE-2011-1319", "CVE-2011-1320");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("IBM WebSphere Application Server 6.1.x < 6.1.0.35, 7.x < 7.0.0.15 Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2011 Greenbone AG");
  script_family("Web Servers");
  script_dependencies("gb_ibm_websphere_consolidation.nasl");
  script_mandatory_keys("ibm/websphere/detected");

  script_tag(name:"summary", value:"IBM WebSphere Application Server is prone to multiple
  vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  - The Administrative Scripting Tools component, when tracing is enabled, places wsadmin command
  parameters into the 'wsadmin.traceout' and 'trace.log' files, which allows local users to obtain
  potentially sensitive information by reading these files.

  - A double free error which allows remote backend IIOP servers to cause a denial of service by
  rejecting IIOP requests at opportunistic time instants.

  - The Security component allows remote authenticated users to cause a denial of service by using
  a Lightweight Third-Party Authentication (LTPA) token for authentication.

  - The Security component does not properly delete AuthCache entries upon a logout, which might
  allow remote attackers to access the server by leveraging an unattended workstation.");

  script_tag(name:"impact", value:"Successful exploitation will let attackers to obtain sensitive
  information or cause a denial of service.");

  script_tag(name:"affected", value:"IBM WebSphere Application Server version 6.1.x prior to
  6.1.0.35 and 7.x prior to 7.0.0.15.");

  script_tag(name:"solution", value:"Update to version 6.1.0.35, 7.0.0.15 or later.");

  script_xref(name:"URL", value:"http://www-01.ibm.com/support/docview.wss?uid=swg27014463");
  script_xref(name:"URL", value:"http://www-01.ibm.com/support/docview.wss?uid=swg24028405");
  script_xref(name:"URL", value:"http://www-01.ibm.com/support/docview.wss?uid=swg24028875");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (version_in_range_exclusive(version: version, test_version_lo: "6.1", test_version_up: "6.1.0.35")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "6.1.0.35");
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "7.0", test_version_up: "7.0.0.15")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.0.0.15");
  security_message(port: 0, data: report);
  exit(0);
}

exit(99);