CVE-2009-5083: Medium severity ibm tivoli federated identity manager business gateway vulnerability

Published Aug 12, 2011

Updated

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors.

Affected Software

2 affected components

IBM Tivoli Federated Identity Manager=6.2.0

IBM Tivoli Federated Identity Manager=6.2.0.1

Event History

Aug 12, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-5083?

CVE-2009-5083 is considered to have a medium severity level as it allows remote attackers to bypass authentication.

How do I fix CVE-2009-5083?

To fix CVE-2009-5083, upgrade IBM Tivoli Federated Identity Manager to version 6.2.0.2 or later.

What versions of IBM Tivoli Federated Identity Manager are affected by CVE-2009-5083?

CVE-2009-5083 affects version 6.2.0 and 6.2.0.1 of IBM Tivoli Federated Identity Manager.

Can CVE-2009-5083 be exploited remotely?

Yes, CVE-2009-5083 can be exploited remotely, allowing attackers to bypass authentication.

What does CVE-2009-5083 affect in IBM Tivoli Federated Identity Manager?

CVE-2009-5083 affects the OpenID relying party configuration in IBM Tivoli Federated Identity Manager.