ID CVE-2009-1174
Summary The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 07-09-2016 - 15:27)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
aixapar PK80596
bid 34506
confirm
secunia
  • 34131
  • 34461
  • 35301
vupen ADV-2009-1464
Last major update 07-09-2016 - 15:27
Published 31-03-2009 - 14:09
Last modified 07-09-2016 - 15:27
Back to Top