ID CVE-2015-1882
Summary Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
References
Vulnerable Configurations
  • IBM WebSphere Application Server 8.5.0.0
    cpe:2.3:a:ibm:websphere_application_server:8.5.0.0
  • IBM WebSphere Application Server 8.5.0.1 (Fix Pack 1)
    cpe:2.3:a:ibm:websphere_application_server:8.5.0.1
  • IBM WebSphere Application Server 8.5.0.2 (Fix Pack 2)
    cpe:2.3:a:ibm:websphere_application_server:8.5.0.2
  • IBM WebSphere Application Server 8.5.5.0
    cpe:2.3:a:ibm:websphere_application_server:8.5.5.0
  • IBM WebSphere Application Server 8.5.5.1
    cpe:2.3:a:ibm:websphere_application_server:8.5.5.1
  • IBM WebSphere Application Server 8.5.5.2
    cpe:2.3:a:ibm:websphere_application_server:8.5.5.2
  • IBM WebSphere Application Server 8.5.5.33 (Fix Pack 3)
    cpe:2.3:a:ibm:websphere_application_server:8.5.5.3
  • IBM Websphere Application Server 8.5.5.4
    cpe:2.3:a:ibm:websphere_application_server:8.5.5.4
CVSS
Base: 8.5 (as of 03-08-2016 - 15:08)
Impact:
Exploitability:
CWE CWE-362
CAPEC
  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
NASL family Web Servers
NASL id WEBSPHERE_8_5_5_5.NASL
description The IBM WebSphere Application Server running on the remote host is version 6.1.0.47 / 7.0.0.37 / 8.0.0.10 / 8.5.5.5 or prior. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the SNMP component due to improper handling of configuration data. An authenticated, remote attacker can exploit this disclose sensitive information. (CVE-2015-0174) - An unspecified flaw exists in the liberty profile due to improper handling of authData elements. An authenticated, remote attacker can exploit this to gain elevated privileges. (CVE-2015-0175) - An unspecified flaw exists in the liberty profile that is triggered when the run-as user for EJB is not honored under multi-threaded race conditions. An authenticated, remote attacker can exploit this to gain elevated privileges. (CVE-2015-1882) - A flaw exists that allows a remote attacker to execute arbitrary code by connecting to a management port using a specific sequence of instructions. (CVE-2015-1920)
last seen 2019-02-21
modified 2018-08-06
plugin id 83290
published 2015-05-08
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=83290
title IBM WebSphere Application Server Multiple Vulnerabilities
refmap via4
aixapar PI33357
bid 74222
confirm http://www-01.ibm.com/support/docview.wss?uid=swg21697368
sectrack 1032190
Last major update 03-08-2016 - 23:18
Published 27-04-2015 - 08:59
Back to Top