CVE-2009-0506: Medium severity IBM WebSphere Application Server vulnerability
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) multiple CBIND checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable CSIv2 Identity Assertion on affected WAS servers (turn the CSIv2 Identity Assertion setting to disabled in the server configuration/administrative console).
IBM WebSphere Application Server (WAS) on z/OS CSIv2 Identity Assertion = disabled - Compensating control
Prevent EJB interactions between IBM WebSphere Application Server 6.1 instances and pre-6.1 instances (for example, isolate or block EJB traffic or otherwise restrict communications between WAS 6.1 and pre-6.1 systems) to avoid the cross-version EJB interaction scenario described.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0506?
The severity of CVE-2009-0506 is not explicitly stated, but it is an unspecified vulnerability in IBM WebSphere Application Server.
How do I fix CVE-2009-0506?
To fix CVE-2009-0506, upgrade to IBM WebSphere Application Server version 6.0.2.33 or higher.
Which versions of IBM WebSphere Application Server are affected by CVE-2009-0506?
CVE-2009-0506 affects IBM WebSphere Application Server versions 5.1 and 6.0.2 before 6.0.2.33.
What impact does CVE-2009-0506 have on local users?
The exact impact of CVE-2009-0506 on local users is unspecified but may allow for an unknown effect due to certain configurations.
Is IBM WebSphere Application Server on z/OS vulnerable to CVE-2009-0506?
Yes, similar versions of IBM WebSphere Application Server that run on z/OS are susceptible to CVE-2009-0506.