Details of VAR-201410-0082

ID

VAR-201410-0082

CVE

CVE-2014-4809

TITLE

IBM Security Access Manager for Web of WebSEAL In the component Service operation interruption (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2014-004510

DESCRIPTION

The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service (component hang) via unspecified vectors. IBM Security Access Manager for Web is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause CPU utilization to rapidly increase, leading to a denial-of-service condition. It provides user access management and Web application protection function. WebSEAL is one of the Web server components that provides authentication

Trust: 1.98

sources: NVD: CVE-2014-4809 // JVNDB: JVNDB-2014-004510 // BID: 70283 // VULHUB: VHN-72750

AFFECTED PRODUCTS

vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.3	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.2	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.6	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.2	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.4	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.3	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.0	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.1	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.5	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.4	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.8	Trust: 1.0
vendor:	ibm	model:	security access manager for web appliance	scope:	eq	version:	7.0	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.7	Trust: 1.0
vendor:	ibm	model:	security access manager for web appliance	scope:	eq	version:	8.0	Trust: 1.0
vendor:	ibm	model:	security access manager for web software	scope:	eq	version:	8.0.0-iss-wga-fp0005	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	lt	version:	7.x	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	eq	version:	7.0.0-iss-wga-if0009	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	lt	version:	8.x	Trust: 0.8
vendor:	ibm	model:	security access manager for web the appliance	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.03	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.02	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.0.4	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.8	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.7	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.6	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.5	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.4	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.3	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.2	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0.0.1	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	7.0	Trust: 0.3

sources: BID: 70283 // JVNDB: JVNDB-2014-004510 // CNNVD: CNNVD-201410-055 // NVD: CVE-2014-4809

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-4809
value:	HIGH
Trust: 1.0
NVD:	CVE-2014-4809
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201410-055
value:	HIGH
Trust: 0.6
VULHUB:	VHN-72750
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2014-4809
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-72750
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-72750 // JVNDB: JVNDB-2014-004510 // CNNVD: CNNVD-201410-055 // NVD: CVE-2014-4809

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2014-4809

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-055

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201410-055

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004510

PATCH

title:	1685246	url:	http://www-01.ibm.com/support/docview.wss?uid=swg21685246	Trust: 0.8
title:	8.0.0-ISS-WGA-FP0005	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54168	Trust: 0.6
title:	8.0.0-ISS-WGA-FP0005	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54167	Trust: 0.6

sources: JVNDB: JVNDB-2014-004510 // CNNVD: CNNVD-201410-055

EXTERNAL IDS

db:	NVD	id:	CVE-2014-4809	Trust: 2.8
db:	SECUNIA	id:	61294	Trust: 1.1
db:	JVNDB	id:	JVNDB-2014-004510	Trust: 0.8
db:	CNNVD	id:	CNNVD-201410-055	Trust: 0.7
db:	XF	id:	95376	Trust: 0.6
db:	BID	id:	70283	Trust: 0.4
db:	VULHUB	id:	VHN-72750	Trust: 0.1

sources: VULHUB: VHN-72750 // BID: 70283 // JVNDB: JVNDB-2014-004510 // CNNVD: CNNVD-201410-055 // NVD: CVE-2014-4809

REFERENCES

url:	http://www-01.ibm.com/support/docview.wss?uid=swg21685246	Trust: 2.0
url:	http://www-01.ibm.com/support/docview.wss?uid=swg1iv64915	Trust: 1.1
url:	http://secunia.com/advisories/61294	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/95376	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4809	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4809	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/95376	Trust: 0.6
url:	http://www.ibm.com/	Trust: 0.3
url:	http://www-03.ibm.com/software/products/en/access-mgr-web	Trust: 0.3

sources: VULHUB: VHN-72750 // BID: 70283 // JVNDB: JVNDB-2014-004510 // CNNVD: CNNVD-201410-055 // NVD: CVE-2014-4809

CREDITS

IBM

Trust: 0.3

sources: BID: 70283

SOURCES

db:	VULHUB	id:	VHN-72750
db:	BID	id:	70283
db:	JVNDB	id:	JVNDB-2014-004510
db:	CNNVD	id:	CNNVD-201410-055
db:	NVD	id:	CVE-2014-4809

LAST UPDATE DATE

2024-11-23T19:29:13.743000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-72750	date:	2017-08-29T00:00:00
db:	BID	id:	70283	date:	2014-09-29T00:00:00
db:	JVNDB	id:	JVNDB-2014-004510	date:	2014-10-06T00:00:00
db:	CNNVD	id:	CNNVD-201410-055	date:	2014-10-10T00:00:00
db:	NVD	id:	CVE-2014-4809	date:	2024-11-21T02:10:54.443

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-72750	date:	2014-10-03T00:00:00
db:	BID	id:	70283	date:	2014-09-29T00:00:00
db:	JVNDB	id:	JVNDB-2014-004510	date:	2014-10-06T00:00:00
db:	CNNVD	id:	CNNVD-201410-055	date:	2014-10-10T00:00:00
db:	NVD	id:	CVE-2014-4809	date:	2014-10-03T01:55:07.237