cnvd - cnvd-2016-00034

cnvd-2016-00034

Vulnerability from cnvd

Title: IBM WebSphere Process Server和Business Process Manager Advanced不正确SSL/TLS处理漏洞

Description:

IBM WebSphere Process Server和Business Process Manager（BPM）Advanced都是美国IBM公司的产品。IBM WebSphere Process Server是一套业务流程自动化引擎；BPM是一套综合的业务流程管理平台，BPM Advanced是一个高级版。

IBM WebSphere Process Server和BPM Advanced中的Remote Artifact Loader (RAL)存在安全漏洞。由于程序未能正确使用HTTPS连接的SSL。远程攻击者可利用该漏洞获取敏感信息或修改数据。

Severity: 中

Patch Name: IBM WebSphere Process Server和Business Process Manager Advanced不正确SSL/TLS处理漏洞的补丁

Patch Description:

IBM WebSphere Process Server和BPM Advanced中的Remote Artifact Loader (RAL)存在安全漏洞。由于程序未能正确使用HTTPS连接的SSL。远程攻击者可利用该漏洞获取敏感信息或修改数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://www-01.ibm.com/support/docview.wss?uid=swg21971968

Reference: https://www-01.ibm.com/support/docview.wss?uid=swg21971968

Impacted products

Name
['IBM WebSphere Process Server 7.0', 'IBM Business Process Manager Advanced 8.0.-8.0.1.3', 'IBM Business Process Manager Advanced 8.5.0.0 - 8.5.6.0', 'IBM Business Process Manager Advanced \r\n7.5.0.0 - 7.5.1.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-7441"
    }
  },
  "description": "IBM WebSphere Process Server\u548cBusiness Process Manager\uff08BPM\uff09Advanced\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM WebSphere Process Server\u662f\u4e00\u5957\u4e1a\u52a1\u6d41\u7a0b\u81ea\u52a8\u5316\u5f15\u64ce\uff1bBPM\u662f\u4e00\u5957\u7efc\u5408\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\uff0cBPM Advanced\u662f\u4e00\u4e2a\u9ad8\u7ea7\u7248\u3002\r\n\r\nIBM WebSphere Process Server\u548cBPM Advanced\u4e2d\u7684Remote Artifact Loader (RAL)\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u4f7f\u7528HTTPS\u8fde\u63a5\u7684SSL\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u6216\u4fee\u6539\u6570\u636e\u3002",
  "discovererName": "IBM",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www-01.ibm.com/support/docview.wss?uid=swg21971968",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-00034",
  "openTime": "2016-01-06",
  "patchDescription": "IBM WebSphere Process Server\u548cBusiness Process Manager\uff08BPM\uff09Advanced\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM WebSphere Process Server\u662f\u4e00\u5957\u4e1a\u52a1\u6d41\u7a0b\u81ea\u52a8\u5316\u5f15\u64ce\uff1bBPM\u662f\u4e00\u5957\u7efc\u5408\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\uff0cBPM Advanced\u662f\u4e00\u4e2a\u9ad8\u7ea7\u7248\u3002\r\n\r\nIBM WebSphere Process Server\u548cBPM Advanced\u4e2d\u7684Remote Artifact Loader (RAL)\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u4f7f\u7528HTTPS\u8fde\u63a5\u7684SSL\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u6216\u4fee\u6539\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM WebSphere Process Server\u548cBusiness Process Manager Advanced\u4e0d\u6b63\u786eSSL/TLS\u5904\u7406\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM WebSphere Process Server 7.0",
      "IBM Business Process Manager Advanced 8.0.-8.0.1.3",
      "IBM Business Process Manager Advanced 8.5.0.0 - 8.5.6.0",
      "IBM Business Process Manager Advanced \r\n7.5.0.0 - 7.5.1.2"
    ]
  },
  "referenceLink": "https://www-01.ibm.com/support/docview.wss?uid=swg21971968",
  "serverity": "\u4e2d",
  "submitTime": "2016-01-04",
  "title": "IBM WebSphere Process Server\u548cBusiness Process Manager Advanced\u4e0d\u6b63\u786eSSL/TLS\u5904\u7406\u6f0f\u6d1e"
}

CVE-2015-7441 (GCVE-0-2015-7441)

Vulnerability from cvelistv5

Published

2016-01-01 00:00

Modified

2024-08-06 07:51

Severity ?

CWE

Summary

Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.

References

▼	URL	Tags
	http://www.securitytracker.com/id/1034531	vdb-entry, x_refsource_SECTRACK
	https://www-01.ibm.com/support/docview.wss?uid=swg21971968	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760	vendor-advisory, x_refsource_AIXAPAR
	http://www.securitytracker.com/id/1034532	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:27.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1034531",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034531"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www-01.ibm.com/support/docview.wss?uid=swg21971968"
          },
          {
            "name": "JR54760",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760"
          },
          {
            "name": "1034532",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034532"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-05T14:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "1034531",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034531"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www-01.ibm.com/support/docview.wss?uid=swg21971968"
        },
        {
          "name": "JR54760",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760"
        },
        {
          "name": "1034532",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034532"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2015-7441",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1034531",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034531"
            },
            {
              "name": "https://www-01.ibm.com/support/docview.wss?uid=swg21971968",
              "refsource": "CONFIRM",
              "url": "https://www-01.ibm.com/support/docview.wss?uid=swg21971968"
            },
            {
              "name": "JR54760",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760"
            },
            {
              "name": "1034532",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034532"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2015-7441",
    "datePublished": "2016-01-01T00:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:27.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted