CVE-2010-0774: Medium severity IBM WebSphere Application Server Feature Pack for Web Services vulnerability
Published May 17, 2010
·Updated
The (1) JAX-RPC WS-Security 1.0 and (2) JAX-WS runtime implementations in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 do not properly handle WebServices PKCS#7 and PKIPath tokens, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
Affected Software
76 affected components
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.10
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.1
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.5
IBM WebSphere Application Server Feature Pack for Web Services=6.0.0.3
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.15
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.3
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.20
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.13
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.9
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.11
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.28
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.11
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.6
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.2
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.35
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.24
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.21
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.9
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.17
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.15
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.4
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.32
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.17
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.2
IBM WebSphere Application Server Feature Pack for Web Services=6.0.0.1
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.30
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.29
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.23
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.18
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.39
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.16
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.7
IBM WebSphere Application Server Feature Pack for Web Services=6.0.0.2
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.33
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.27
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.12
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.22
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.5
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.7
IBM WebSphere Application Server Feature Pack for Web Services=6.0
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.3
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.19
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.1
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.25
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.37
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.8
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.14
IBM WebSphere Application Server Feature Pack for Web Services=6.0.1.13
IBM WebSphere Application Server Feature Pack for Web Services=6.0.2.31
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.21
IBM WebSphere Application Server Feature Pack for Web Services=6.1
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.19
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.2
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.25
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.11
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.9
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.0
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.1
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.27
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.29
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.7
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.3
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.17
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.13
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.15
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.23
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0
IBM WebSphere Application Server Feature Pack for Web Services=6.1.0.5
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.5
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.9
IBM WebSphere Application Server Feature Pack for Web Services=7.0
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.7
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.3
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.1
Event History
May 17, 2010
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Data Sourced
via NVD·10:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0774?
CVE-2010-0774 is considered high severity due to the risk of unauthorized access.
2
How do I fix CVE-2010-0774?
To fix CVE-2010-0774, upgrade IBM WebSphere Application Server to a version that is patched, specifically 6.0.2.41, 6.1.0.31, or 7.0.0.11 and later.
3
What versions of IBM WebSphere Application Server are affected by CVE-2010-0774?
CVE-2010-0774 affects IBM WebSphere Application Server versions prior to 6.0.2.41, 6.1.0.31, and 7.0.0.11.
4
Is CVE-2010-0774 a remote attack vulnerability?
Yes, CVE-2010-0774 is a vulnerability that allows remote attackers to bypass access controls.
5
What types of tokens are improperly handled in CVE-2010-0774?
CVE-2010-0774 improperly handles WebServices PKCS#7 and PKIPath tokens.