CVE-2013-0482
First published: Wed May 29 2013(Updated: )
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.1 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.2 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.3 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.4 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.5 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.6 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.7 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.8 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.9 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.10 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.11 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.12 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.13 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.14 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.15 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.16 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.17 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.18 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.19 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.21 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.22 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.23 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.24 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.25 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =7.0.0.27 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.0 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.1 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.2 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.3 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.4 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.0.0.5 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.5.0.0 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.5.0.1 | |
| IBM WebSphere Message Broker | =6.1 | |
| IBM WebSphere Message Broker | =7.0. | |
| IBM WebSphere Message Broker | =7.0.0.1 | |
| IBM WebSphere Message Broker | =7.0.0.2 | |
| IBM WebSphere Message Broker | =7.0.0.3 | |
| IBM WebSphere Message Broker | =7.0.0.4 | |
| IBM WebSphere Message Broker | =7.0.0.5 | |
| IBM WebSphere Message Broker | =8.0 | |
| IBM WebSphere Message Broker | =8.0.0.1 | |
| IBM WebSphere Message Broker | =8.0.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC88185
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM76582
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM86026
- http://www-01.ibm.com/support/docview.wss?uid=swg21634646
- http://www-01.ibm.com/support/docview.wss?uid=swg21635474
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81548
Frequently Asked Questions
What is the severity of CVE-2013-0482?
CVE-2013-0482 has a medium severity level as it allows remote attackers to spoof message signatures.
How do I fix CVE-2013-0482?
To fix CVE-2013-0482, update IBM WebSphere Application Server or WebSphere Message Broker to the latest versions provided by IBM.
Which versions are affected by CVE-2013-0482?
CVE-2013-0482 affects IBM WebSphere Application Server versions 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 up to 8.5.0.2, along with certain versions of WebSphere Message Broker.
What is the nature of the vulnerability in CVE-2013-0482?
The vulnerability in CVE-2013-0482 allows remote attackers to create crafted SOAP messages that can spoof message signatures.
Is CVE-2013-0482 critical for my infrastructure?
The criticality of CVE-2013-0482 depends on the deployment of the affected software and exposure to untrusted sources.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm websphere application server feature pack for web services
- version/ibm websphere application server feature pack for web services/7.0
- version/ibm websphere application server feature pack for web services/7.0.0.1
- version/ibm websphere application server feature pack for web services/7.0.0.2
- version/ibm websphere application server feature pack for web services/7.0.0.3
- version/ibm websphere application server feature pack for web services/7.0.0.4
- version/ibm websphere application server feature pack for web services/7.0.0.5
- version/ibm websphere application server feature pack for web services/7.0.0.6
- version/ibm websphere application server feature pack for web services/7.0.0.7
- version/ibm websphere application server feature pack for web services/7.0.0.8
- version/ibm websphere application server feature pack for web services/7.0.0.9
- version/ibm websphere application server feature pack for web services/7.0.0.10
- version/ibm websphere application server feature pack for web services/7.0.0.11
- version/ibm websphere application server feature pack for web services/7.0.0.12
- version/ibm websphere application server feature pack for web services/7.0.0.13
- version/ibm websphere application server feature pack for web services/7.0.0.14
- version/ibm websphere application server feature pack for web services/7.0.0.15
- version/ibm websphere application server feature pack for web services/7.0.0.16
- version/ibm websphere application server feature pack for web services/7.0.0.17
- version/ibm websphere application server feature pack for web services/7.0.0.18
- version/ibm websphere application server feature pack for web services/7.0.0.19
- version/ibm websphere application server feature pack for web services/7.0.0.21
- version/ibm websphere application server feature pack for web services/7.0.0.22
- version/ibm websphere application server feature pack for web services/7.0.0.23
- version/ibm websphere application server feature pack for web services/7.0.0.24
- version/ibm websphere application server feature pack for web services/7.0.0.25
- version/ibm websphere application server feature pack for web services/7.0.0.27
- version/ibm websphere application server feature pack for web services/8.0.0.0
- version/ibm websphere application server feature pack for web services/8.0.0.1
- version/ibm websphere application server feature pack for web services/8.0.0.2
- version/ibm websphere application server feature pack for web services/8.0.0.3
- version/ibm websphere application server feature pack for web services/8.0.0.4
- version/ibm websphere application server feature pack for web services/8.0.0.5
- version/ibm websphere application server feature pack for web services/8.5.0.0
- version/ibm websphere application server feature pack for web services/8.5.0.1
- canonical/ibm websphere message broker
- version/ibm websphere message broker/6.1
- version/ibm websphere message broker/7.0.
- version/ibm websphere message broker/7.0.0.1
- version/ibm websphere message broker/7.0.0.2
- version/ibm websphere message broker/7.0.0.3
- version/ibm websphere message broker/7.0.0.4
- version/ibm websphere message broker/7.0.0.5
- version/ibm websphere message broker/8.0
- version/ibm websphere message broker/8.0.0.1
- version/ibm websphere message broker/8.0.0.2