NVD

Id
4493  
Name
CVE-2008-4679  
Description
The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the "Java security method" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-10-22  
Modified Date
2011-03-07  
Seq
2008-4679  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
28239 4493 CVE-2008-4679 http://www-01.ibm.com/support/docview.wss?uid=swg27006876  View
28240 4493 CVE-2008-4679 http://www-01.ibm.com/support/docview.wss?uid=swg27007951  View
28241 4493 CVE-2008-4679 PK61258  View
28242 4493 CVE-2008-4679 31839  View
28243 4493 CVE-2008-4679 ADV-2008-2871  View
28244 4493 CVE-2008-4679 websphere-crl-weak-security(46002)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46576 JVNDB-2008-001886 IBM WAS の Web Services Security コンポーネントにおけるアクセス制限を回避される脆弱性 IBM WebSphere Application Server (WAS) の Web Services Security コンポーネントには、Certificate Revocation Lists (CRL) を使用するよう Certificate Store Collections を設定している場合に、PKIXBuilderParameters オブジェクト上の setRevocationEnabled メソッドを呼び出さないため、Java セキュリティメソッドが X.509 証明書の廃止ステータスをチェックをしない脆弱性が存在します。 CVE-2008-4679 34792 CVE-2008-4679 4493 6.8 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001886.html 2008-10-20 2008-11-21 View