CVE-2015-5012
HighSummary
The SSH implementation on IBM Security Access Manager for Web before version 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, making it easier for remote attackers to defeat cryptographic protection mechanisms.
Risk Assessment
The organization may be exposed to attacks that could lead to data compromise and breach of confidentiality.
Recommendation
It is recommended to upgrade to the latest version of IBM Security Access Manager for Web to minimize the risk associated with this vulnerability.
Other vulnerabilities in IBM Security Access Manager for Web
See all- CVE-2016-5919High
IBM Security Access Manager for Web versions 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CVE-2016-3029High
IBM Security Access Manager for Web is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
- CVE-2016-3017High
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.
- CVE-2015-5010High
IBM Security Access Manager for Web versions 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 lacks a lockout mechanism for invalid login attempts, making it easier for remote attackers to gain access via a brute-force attack.
- CVE-2015-4963High
IBM Security Access Manager for Web versions 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandle WebSEAL HTTPTransformation requests, allowing remote attackers to read or write to arbitrary files.
Original NVD description (English source)
The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.