CVE-2012-6359: Medium severity ibm tivoli federated identity manager business gateway vulnerability
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6359?
CVE-2012-6359 has a moderate severity level due to improper validation of OpenID attributes.
How do I fix CVE-2012-6359?
To fix CVE-2012-6359, upgrade to IBM Tivoli Federated Identity Manager version 6.2.0.11, 6.2.1.3, or 6.2.2.2 or higher.
Which versions of IBM Tivoli Federated Identity Manager are affected by CVE-2012-6359?
CVE-2012-6359 affects IBM Tivoli Federated Identity Manager versions 6.2.0, 6.2.1, and 6.2.2 before their respective patches.
Is IBM Tivoli Federated Identity Manager Business Gateway impacted by CVE-2012-6359?
Yes, the IBM Tivoli Federated Identity Manager Business Gateway versions listed are also impacted by CVE-2012-6359.
What are the implications of CVE-2012-6359 for organizations?
Organizations may face security risks such as unauthorized access if CVE-2012-6359 is not addressed promptly.