CVE-2009-5085: Low severity ibm tivoli federated identity manager business gateway vulnerability
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions via vectors that trigger absence of the consent-to-authenticate page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5085?
CVE-2009-5085 is classified as a medium severity vulnerability due to the potential for user-assisted exploitation.
How do I fix CVE-2009-5085?
To mitigate CVE-2009-5085, upgrade IBM Tivoli Federated Identity Manager to version 6.2.0.2 or later.
What types of attacks are possible with CVE-2009-5085?
CVE-2009-5085 allows user-assisted remote attackers to bypass trust restrictions by exploiting the failure to delete a site information cookie.
Which versions of IBM Tivoli Federated Identity Manager are affected by CVE-2009-5085?
IBM Tivoli Federated Identity Manager versions 6.2.0 and 6.2.0.1 are affected by CVE-2009-5085.
What is the impact of the vulnerability described in CVE-2009-5085?
The impact of CVE-2009-5085 is that it can allow unauthorized access to resources if the appropriate trust restrictions are bypassed.