CVE-2009-5084: Low severity ibm tivoli federated identity manager business gateway vulnerability

Published Aug 12, 2011

Updated

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data.

Affected Software

2 affected components

IBM Tivoli Federated Identity Manager=6.2.0

IBM Tivoli Federated Identity Manager=6.2.0.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44560

Event History

Aug 12, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-5084?

The severity of CVE-2009-5084 is classified as medium due to the exposure of sensitive password information in log files.

How do I fix CVE-2009-5084?

To fix CVE-2009-5084, upgrade IBM Tivoli Federated Identity Manager to version 6.2.0.2 or later.

What does CVE-2009-5084 affect?

CVE-2009-5084 affects IBM Tivoli Federated Identity Manager versions 6.2.0 and 6.2.0.1.

What is the impact of CVE-2009-5084?

The impact of CVE-2009-5084 is that local users may access cleartext passwords from log files, posing a risk to sensitive information.

Is CVE-2009-5084 still relevant?

Although CVE-2009-5084 is from 2009, it remains relevant for organizations still using the affected versions of IBM Tivoli Federated Identity Manager.