CVE-2011-3138: Medium severity ibm tivoli federated identity manager business gateway vulnerability
The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3138?
CVE-2011-3138 is considered to have a medium severity rating due to the potential for bypassing security mechanisms.
How do I fix CVE-2011-3138?
To fix CVE-2011-3138, upgrade IBM Tivoli Federated Identity Manager to version 6.2.0.9 or later.
What systems are affected by CVE-2011-3138?
CVE-2011-3138 affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway versions earlier than 6.2.0.9.
What type of vulnerability is CVE-2011-3138?
CVE-2011-3138 is a security vulnerability related to improper configuration in the LTPA STS module of the affected software.
Can CVE-2011-3138 be exploited remotely?
Yes, CVE-2011-3138 can potentially be exploited remotely, allowing attackers to bypass authentication.