----------------------------------------------------------------------

Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch

----------------------------------------------------------------------

TITLE:
IBM Rational Products Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA48967

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48967/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48967

RELEASE DATE:
2012-04-25

DISCUSS ADVISORY:
http://secunia.com/advisories/48967/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/48967/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=48967

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Multiple vulnerabilities are reported in multiple IBM Rational
products, which can be exploited by malicious users to disclose
sensitive information and conduct session fixation and script
insertion attacks and by malicious people to disclose sensitive
information, overwrite arbitrary files, conduct cross-site request
forgery and spoofing attacks, and compromise a vulnerable system.

1) An error in certain configurations can be exploited to download
arbitrary files from local resources.

2) An error when the Integrated Windows authentication is enabled can
be exploited to hijack the service account session.

3) An error when importing jobs can be exploited to disclose
sensitive information.

4) An error when scanning FILE URIs can be exploited to disclose
sensitive information.

5) An error in when creating scan jobs can be exploited to execute
arbitrary code by tricking a user into scanning a malicious website.

6) The application does not properly verify uploaded file types,
which can be exploited to execute arbitrary ASP.NET code by uploading
an ASP.NET file.

7) The application's web interface allows users to perform certain
actions via HTTP requests without performing any validity checks to
verify the requests. This can be exploited to e.g. add administrator
accounts by tricking a logged in user into visiting a malicious web
site.

8) Certain unspecified input is not properly sanitised before being
used. This can be exploited to insert arbitrary HTML and script code,
which will be executed in a user's browser session in context of an
affected site when the malicious data is being viewed.

9) An error in the Enterprise Console is not properly validating SSL
certificates and can be exploited to conduct spoofing and
Man-in-the-Middle (MitM) attacks.

10) The application bundles a vulnerable version of the ChilkatZip2
ActiveX control.

For more information:
SA25962

The vulnerabilities are reported in IBM Rational AppScan, IBM
Rational AppScan Reporting Console, and IBM Rational Policy Tester
versions 8.0 and 8.5.

SOLUTION:
Update to version 8.5.0 FP1 (8.5.0.1).

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www.ibm.com/support/docview.wss?uid=swg21592188
http://xforce.iss.net/xforce/xfdb/74371
http://xforce.iss.net/xforce/xfdb/74374
http://xforce.iss.net/xforce/xfdb/74557
http://xforce.iss.net/xforce/xfdb/74558
http://xforce.iss.net/xforce/xfdb/74559
http://xforce.iss.net/xforce/xfdb/74366
http://xforce.iss.net/xforce/xfdb/74370
http://xforce.iss.net/xforce/xfdb/74560
http://xforce.iss.net/xforce/xfdb/74389
http://xforce.iss.net/xforce/xfdb/35294

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------