CIA RESEARCH
Alerts
[CIA-1044-Alert] IBM Tivoli Access Manager Directory Traversal Vulnerability
Summary:
A vulnerability in the IBM Tivoli Access Manger lets a remotely authenticated user access arbitrary files via directory traversal attacks.
Technical Details:
Versions 5.1.0 and 6.0.0 of the IBM Tivoli Access Manager is vulnerabile to directory traversal attacks when the Web Server plugin-in component is installed. An authenticated user can use "../" characters to access files outside of the web server document root. File access will occur with the privileges of the Access Manager process.
Example:
http://[target]/pkmslogout?filename=../../../../../../../etc/passwd
The vulnerability results from the 'pkmslogout' script that fails to properly santize user input. The dot-dot-slash characters are interpreted by the underlying OS and allow the request to target files outside of the web server document root.
Solution:
IBM has released a security fix for each of the affected platforms.
Fixpack 5.1.0-TIV-WPI-FP0017
Fixpack 6.0.0-TIV-WPI-FP0001
CVE Reference:
CVE-2006-0513
SecurityTracker Number(s):
1015582
About the Cenzic CIA Team:
Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research
for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing,
and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has
dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities
but also vulnerabilities found in customer applications and make them available to our customers
and to the community at large.
About Cenzic:
Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application
security assessment and compliance that allows corporations and government organizations to
dramatically improve the security of commercial and custom applications. Hailstorm enables security
experts, QA professionals, and developers to work together to assess, analyze, and remediate
applications for security vulnerabilities, and verify compliance with security policies. Benefits
include reduced security risk and liability, lower development and testing costs, and faster
time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces
sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC
|
