CVE-2014-3053

The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0, and 8.0 with firmware 8.0.0.2 and 8.0.0.3, allows remote attackers to bypass authentication via a login action with invalid credentials.

CVSS v2.0 8.0 HIGH

8.0^/10

CVSS v2.0 : HIGH

Vector : AV:A/AC:L/Au:N/C:C/I:P/A:C

Exploitability : 6.5 / Impact : 9.5

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/59381
http://secunia.com/advisories/59438
http://www-01.ibm.com/support/docview.wss?uid=swg1IV61557
http://www-01.ibm.com/support/docview.wss?uid=swg21676389
http://www-01.ibm.com/support/docview.wss?uid=swg21676700	Vendor Advisory
http://www.securityfocus.com/bid/68132
https://exchange.xforce.ibmcloud.com/vulnerabilities/93501

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:::::::*
	cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:::::::*

cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:security_access_manager_for_mobile_software:8.0:::::::*
	cpe:2.3:a:ibm:security_access_manager_for_web_software:7.0:::::::*
	cpe:2.3:a:ibm:security_access_manager_for_web_software:8.0:::::::*
	cpe:2.3:h:ibm:security_access_manager_for_mobile_appliance:8.0:::::::*
	cpe:2.3:h:ibm:security_access_manager_for_web_appliance:7.0:::::::*
	cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:::::::*

History

No history.

Information

Published : 2014-06-21 15:55

Updated : 2017-08-29 01:34

NVD link : CVE-2014-3053

Mitre link : CVE-2014-3053

CVE.ORG link : CVE-2014-3053

JSON object : View

Products Affected

ibm

security_access_manager_for_mobile_software
security_access_manager_for_web_8.0_firmware
security_access_manager_for_web_appliance
security_access_manager_for_mobile_appliance
security_access_manager_for_web_software

CWE

CWE-287

Improper Authentication

{"id": "CVE-2014-3053", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.0, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:C/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 9.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-21T15:55:03.870", "references": [{"url": "http://secunia.com/advisories/59381", "source": "psirt@us.ibm.com"}, {"url": "http://secunia.com/advisories/59438", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV61557", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676389", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676700", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/68132", "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93501", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0, and 8.0 with firmware 8.0.0.2 and 8.0.0.3, allows remote attackers to bypass authentication via a login action with invalid credentials."}, {"lang": "es", "value": "Local Management Interface (LMI) en IBM Security Access Manager (ISAM) for Mobile 8.0 con firmware 8.0.0.0 hasta 8.0.0.3 y IBM Security Access Manager for Web 7.0 y 8.0 con firmware 8.0.0.2 y 8.0.0.3, permite a atacantes remotos evadir autenticaci\u00f3n a trav\u00e9s de una acci\u00f3n de inicio de sesi\u00f3n con credenciales inv\u00e1lidas."}], "lastModified": "2017-08-29T01:34:36.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97E19969-DD73-42F2-9E91-504E1663B268"}, {"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9CC2E05-5179-4241-A710-E582510EEB0D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C5EBB4D-36F8-453C-9D2C-A63490144596"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_access_manager_for_mobile_software:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "673DB620-B3D4-431D-A8F8-0EA4F53EC3AA"}, {"criteria": "cpe:2.3:a:ibm:security_access_manager_for_web_software:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BACDCBD6-EEF3-4259-9866-A89105AA4C19"}, {"criteria": "cpe:2.3:a:ibm:security_access_manager_for_web_software:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97CBEC75-1164-4E25-8D32-DBA39C6E8A25"}, {"criteria": "cpe:2.3:h:ibm:security_access_manager_for_mobile_appliance:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "506C4B29-BC71-4C56-BAB1-06E63BEB1DD3"}, {"criteria": "cpe:2.3:h:ibm:security_access_manager_for_web_appliance:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7844D23-8DAB-4A9A-B0D4-734DF8FBFE02"}, {"criteria": "cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C5EBB4D-36F8-453C-9D2C-A63490144596"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}