-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0099
  A vulnerability has been identified in IBM WebSphere Application Server
                                5 July 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              IBM WebSphere Application Server 6.0.2
                      IBM WebSphere Application Server 6.1
                      IBM WebSphere Application Server 7.0
                      IBM WebSphere Application Server 8.0
Operating System:     AIX
                      HP-UX
                      Linux variants
                      Solaris
                      Windows
                      IBM i
                      i5/OS
                      z/OS
Impact/Access:        Increased Privileges -- Existing Account
Resolution:           Patch/Upgrade
CVE Names:            CVE-2011-1377  
Member content until: Saturday, August  4 2012
Reference:            ESB-2012.0385

OVERVIEW

        A vulnerability has been identified in IBM WebSphere Application Server
        versions 6.0.2, 6.1, 7.0 and 8.0. [1]


IMPACT

        The vendor has provided the following details regarding this
        vulnerability which has been assigned CVE-2011-1377:
        
        "WebSphere Application Server could provide weaker than expected 
        security when using web services security (WS-Security). A user could 
        randomly gain elevated privileges on the provider system. WS-Security 
        may assign the identity of a previously processed LTPA token to a new 
        inbound LTPA token after authentication. This impacts applications 
        using either JAX-WS and JAX-RPC" [1]


MITIGATION

        The vendor recommends applying the relevant Fix Packs or Interim
        Fix APARs to correct this issue. [1]


REFERENCES

        [1] Possible security exposure with WebSphere Application Server with
            WS-Security enabled applications using LTPA tokens
            (PM43585/PM43792/PM45181)
            http://www-01.ibm.com/support/docview.wss?uid=swg21587536

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT/T6eO4yVqjM2NGpAQJDHQ//TmawYmgFD5jQ8NAqkPEbYu+SXnNR+Z6V
G5Xir1moCRrR6Z7JuELVOPP1fi89rYZ2y+ufor/MDIKhCGp6HQGlrQ0GNBbH39tL
4BY2UfM7JkIUYOkTuoxTaCzUOrHYZcgKc40PYV4Dtunwdc829tbfjcwc8g043T8j
licRP4fVuf8Fr1rxaO1qC34JzCJUdVKeOuQUeSMTdpxor8wk7WOXJIiQej56+DxM
Iw20D2f//2Qy3/29dA+hZKFdWgkG7k2qRyieo9Z/GH1LXGj+NWt13gBBkYx5sfqM
opV7v172Tgc1vSgH1WGG+vVLwqCGRKfT652mknd+zJJWtB42rPICN/lyIlJrmzDl
6y3o94yJWtCFGUm8UoCnDLXQ8IVqHIaAYloFnEII3c9Pr7Wg+d9HDHhyTSYAPqlp
Ekv0UiG8XHyj77IsmigIpCcbNsRj4ZUw2LsAT3qOA38iClLHHD75OHAh5Mo818/K
JYmSQjev/Ignk6+N7hZ+CVw316e91jVfAhA0X+nQ/pRDeiKPuxVgWBhY0LBY0iB0
hxdOQVZfIRXiEUbJ5cLuOWZLJIY6nPMlpAR+qnfuYM1AZ4mOhrLwW9G46dxdP0gG
OdW2EYI5MIax32gJ+cIFytHXuGRYybtRsW0nj33u6sJTKpKpdvJVqiPtThg6T9vv
KltjW6M5pcY=
=q8MT
-----END PGP SIGNATURE-----