CVE-2012-6359
First published: Fri Jan 18 2013(Updated: )
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Tivoli Federated Identity Manager | =6.2.0 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.1 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.2 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.3 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.8 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.9 | |
| IBM Tivoli Federated Identity Manager | =6.2.0.10 | |
| IBM Tivoli Federated Identity Manager | =6.2.1 | |
| IBM Tivoli Federated Identity Manager | =6.2.1.1 | |
| IBM Tivoli Federated Identity Manager | =6.2.1.2 | |
| IBM Tivoli Federated Identity Manager | =6.2.2 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.1 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.2 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.3 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.8 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.9 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.0.10 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.1 | |
| Ibm Tivoli Federated Identity Manager Business Gateway | =6.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/51212
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23451
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23453
- http://www-01.ibm.com/support/docview.wss?uid=swg21615744
- http://www-01.ibm.com/support/docview.wss?uid=swg21615748
- http://www.securityfocus.com/bid/56390
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77790
- collector/nvd-index
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm tivoli federated identity manager
- version/ibm tivoli federated identity manager/6.2.0
- version/ibm tivoli federated identity manager/6.2.0.1
- version/ibm tivoli federated identity manager/6.2.0.2
- version/ibm tivoli federated identity manager/6.2.0.3
- version/ibm tivoli federated identity manager/6.2.0.8
- version/ibm tivoli federated identity manager/6.2.0.9
- version/ibm tivoli federated identity manager/6.2.0.10
- version/ibm tivoli federated identity manager/6.2.1
- version/ibm tivoli federated identity manager/6.2.1.1
- version/ibm tivoli federated identity manager/6.2.1.2
- version/ibm tivoli federated identity manager/6.2.2
- canonical/ibm tivoli federated identity manager business gateway
- version/ibm tivoli federated identity manager business gateway/6.2.0
- version/ibm tivoli federated identity manager business gateway/6.2.0.1
- version/ibm tivoli federated identity manager business gateway/6.2.0.2
- version/ibm tivoli federated identity manager business gateway/6.2.0.3
- version/ibm tivoli federated identity manager business gateway/6.2.0.8
- version/ibm tivoli federated identity manager business gateway/6.2.0.9
- version/ibm tivoli federated identity manager business gateway/6.2.0.10
- version/ibm tivoli federated identity manager business gateway/6.2.1
- version/ibm tivoli federated identity manager business gateway/6.2.2