NVD

Id
9830  
Name
CVE-2011-3138  
Description
The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-08-12  
Modified Date
2011-09-06  
Seq
2011-3138  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
56410 9830 CVE-2011-3138 IV01318  View
56411 9830 CVE-2011-3138 http://www.ibm.com/support/docview.wss?uid=swg24029497  View
56412 9830 CVE-2011-3138 http://www.ibm.com/support/docview.wss?uid=swg24029498  View
56413 9830 CVE-2011-3138 ibm-tfim-security-bypass(69198)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34623 JVNDB-2011-004865 IBM TFIM および TFIMBG の LTPA STS モジュールサポート実装における LTPA トークンシグネチャの検証を回避する脆弱性 IBM Tivoli Federated Identity Manager (TFIM) および Tivoli Federated Identity Manager Business Gateway (TFIMBG) の LTPA STS モジュールサポート実装は、Java Development Kit (JDK) クラスの静的インスタンスに依存するため、LTPA トークンシグネチャの検証を回避する脆弱性が存在します。 CVE-2011-3138 51045 CVE-2011-3138 9830 5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004865.html 2011-06-02 2012-03-27 View