----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
IBM WebSphere Application Server Two Vulnerabilities

SECUNIA ADVISORY ID:
SA39140

VERIFY ADVISORY:
http://secunia.com/advisories/39140/

DESCRIPTION:
Two vulnerabilities have been reported in IBM WebSphere Application
Server, which can be exploited by malicious users to disclose
potentially sensitive information and cause a DoS (Denial of
Service).

1) An error when defining a wsadmin scripting J2CConnectionFactory
object results in passwords being stored unencrypted in the
resources.xml file.

2) An error during the SSL handshake with ORB clients causes the ORB
thread to hang and prevents other clients from connecting.

The vulnerabilities are reported in versions 6.0, 6.1, and 7.0.

SOLUTION:
Apply fixes.

IBM WebSphere Application Server 6.0.x:
Apply APARs PK95089 and PK93653 or Fix Pack 41 (6.0.2.41) when it
becomes available.

IBM WebSphere Application Server 6.1.x:
Apply APARs PK95089 and PK93653 or Fix Pack 31 (6.1.0.31) when it
becomes available.

IBM WebSphere Application Server 7.0.x:
Update to Fix Pack 9 (7.0.0.9).
http://www-01.ibm.com/support/docview.wss?uid=swg27004980

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
IBM (PK95089 and PK93653):
http://www-01.ibm.com/support/docview.wss?uid=swg27004980

OTHER REFERENCES:
ISS X-Force:
http://xforce.iss.net/xforce/xfdb/57182
http://xforce.iss.net/xforce/xfdb/57185

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------