CVE-2013-4053: Input Validation
Published Sep 20, 2013
·Updated
The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly verify X.509 certificates, which allows remote attackers to obtain privileged access via unspecified vectors.
Affected Software
87 affected components
IBM WebSphere Application Server=8.5.0.0
IBM WebSphere Application Server=8.5.0.1
IBM WebSphere Application Server=8.5.0.2
IBM WebSphere Application Server=8.5.5.0
IBM WebSphere Application Server=7.0
IBM WebSphere Application Server=7.0.0.1
IBM WebSphere Application Server=7.0.0.2
IBM WebSphere Application Server=7.0.0.3
IBM WebSphere Application Server=7.0.0.4
IBM WebSphere Application Server=7.0.0.5
IBM WebSphere Application Server=7.0.0.6
IBM WebSphere Application Server=7.0.0.7
IBM WebSphere Application Server=7.0.0.8
IBM WebSphere Application Server=7.0.0.9
IBM WebSphere Application Server=7.0.0.10
IBM WebSphere Application Server=7.0.0.11
IBM WebSphere Application Server=7.0.0.12
IBM WebSphere Application Server=7.0.0.13
IBM WebSphere Application Server=7.0.0.14
IBM WebSphere Application Server=7.0.0.15
IBM WebSphere Application Server=7.0.0.16
IBM WebSphere Application Server=7.0.0.17
IBM WebSphere Application Server=7.0.0.18
IBM WebSphere Application Server=7.0.0.19
IBM WebSphere Application Server=7.0.0.21
IBM WebSphere Application Server=7.0.0.22
IBM WebSphere Application Server=7.0.0.23
IBM WebSphere Application Server=7.0.0.24
IBM WebSphere Application Server=7.0.0.25
IBM WebSphere Application Server=7.0.0.27
IBM WebSphere Application Server=7.0.0.29
IBM WebSphere Application Server=8.0.0.0
IBM WebSphere Application Server=8.0.0.1
IBM WebSphere Application Server=8.0.0.2
IBM WebSphere Application Server=8.0.0.3
IBM WebSphere Application Server=8.0.0.4
IBM WebSphere Application Server=8.0.0.5
IBM WebSphere Application Server=8.0.0.6
IBM WebSphere Application Server=8.0.0.7
IBM WebSphere Application Server=6.1
IBM WebSphere Application Server=6.1.0
IBM WebSphere Application Server=6.1.0.0
IBM WebSphere Application Server=6.1.0.1
IBM WebSphere Application Server=6.1.0.2
IBM WebSphere Application Server=6.1.0.3
IBM WebSphere Application Server=6.1.0.5
IBM WebSphere Application Server=6.1.0.7
IBM WebSphere Application Server=6.1.0.9
IBM WebSphere Application Server=6.1.0.11
IBM WebSphere Application Server=6.1.0.12
IBM WebSphere Application Server=6.1.0.13
IBM WebSphere Application Server=6.1.0.14
IBM WebSphere Application Server=6.1.0.15
IBM WebSphere Application Server=6.1.0.17
IBM WebSphere Application Server=6.1.0.19
IBM WebSphere Application Server=6.1.0.21
IBM WebSphere Application Server=6.1.0.23
IBM WebSphere Application Server=6.1.0.25
IBM WebSphere Application Server=6.1.0.27
IBM WebSphere Application Server=6.1.0.29
IBM WebSphere Application Server=6.1.0.31
IBM WebSphere Application Server=6.1.0.33
IBM WebSphere Application Server=6.1.0.35
IBM WebSphere Application Server=6.1.0.37
IBM WebSphere Application Server=6.1.0.39
IBM WebSphere Application Server=6.1.0.41
IBM WebSphere Application Server=6.1.0.43
IBM WebSphere Application Server=6.1.0.45
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.11
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.13
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.15
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.17
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.19
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.21
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.23
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.25
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.27
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.29
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.31
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.33
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.35
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.37
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.39
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.41
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.43
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.45
IBM Websphere Application Server Feature Pack For Web Services=6.1.0.47
Event History
Sep 20, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4053?
CVE-2013-4053 is rated as moderate severity.
2
How do I fix CVE-2013-4053?
To fix CVE-2013-4053, you should upgrade IBM WebSphere Application Server to the latest version that addresses this vulnerability.
3
Which versions of IBM WebSphere Application Server are affected by CVE-2013-4053?
CVE-2013-4053 affects IBM WebSphere Application Server versions 6.1 prior to 6.1.0.47, 7.0 prior to 7.0.0.31, 8.0 prior to 8.0.0.8, and 8.5 prior to 8.5.5.1.
4
What type of issue is CVE-2013-4053 related to?
CVE-2013-4053 is related to improper validation of XML Digital Signatures in the WS-Security implementation.
5
Can CVE-2013-4053 lead to security risks?
Yes, CVE-2013-4053 can lead to potential security risks due to inadequate trust store configuration for XML Digital Signatures.