Vulnerabilities > CVE-2015-1886 - Resource Management Errors vulnerability in IBM Websphere Portal

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(83055);
  script_version("1.7");
  script_cvs_date("Date: 2018/08/06 14:03:14");

  script_cve_id("CVE-2015-1886", "CVE-2015-1908");
  script_bugtraq_id(74216, 74218);

  script_name(english:"IBM WebSphere Portal Multiple Vulnerabilities (PI37356, PI37661)");
  script_summary(english:"Checks for the installed patches.");

  script_set_attribute(attribute:"synopsis", value:
"The web portal software installed on the remote Windows host is
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The IBM WebSphere Portal installed on the remote host is version
6.1.0.x prior to 6.1.0.6 CF27, 6.1.5.x prior to 6.1.5.3 CF27, 7.0.0.x
prior to 7.0.0.2 CF29, 8.0.0.x prior to 8.0.0.1 CF16, or 8.5.0.0 prior
to 8.5.0.0 CF05. It is, therefore, affected by multiple
vulnerabilities :

  - An unspecified flaw exists due to improper validation of
    user-supplied input. A remote attacker, using specially
    crafted requests, can exploit this to cause a denial of
    service by consuming all memory resources. Note that
    this only affects hosts in which the 'Remote Document
    Conversion Service' is enabled. (CVE-2015-1886, PI37356)

  - An unspecified cross-site scripting vulnerability exists
    due to improper validation of user-supplied input. A
    remote attacker, using a specially crafted URL, can
    exploit this to execute code in a victim's web browser
    within the security context of the hosted site, possibly
    resulting in access to the cookie-based authentication
    credentials. (CVE-2015-1908, PI37661)");
  script_set_attribute(attribute:"see_also", value:"https://www-304.ibm.com/support/docview.wss?uid=swg21701566");
  script_set_attribute(attribute:"solution", value:
"Upgrade IBM WebSphere Portal as noted in the referenced IBM advisory.

  - Versions 6.1.0.x should upgrade to 6.1.0.6 CF27 and then
    apply interim fixes PI37356 and PI37661.

  - Versions 6.1.5.x should upgrade to 6.1.5.3 CF27 and then
    apply interim fixes PI37356 and PI37661.

  - Versions 7.0.0.x should upgrade to 7.0.0.2 CF29 and then
    apply interim fixes PI37356 and PI37661.

  - Versions 8.0.0.x should upgrade to 8.0.0.1 CF16.

  - Versions 8.5.0.x should upgrade to 8.5.0.0 CF05 and then
    apply interim fixes PI37356 and PI37661.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/04/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/04/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/04/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_portal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");

  script_dependencies("websphere_portal_installed.nbin");
  script_require_keys("installed_sw/IBM WebSphere Portal");

  exit(0);
}

include("websphere_portal_version.inc");

fixes = make_list("PI37356", "PI37661");

websphere_portal_check_version(
  checks:make_array(
    "8.5.0.0, 8.5.0.0, CF05", fixes,
    "8.0.0.0, 8.0.0.1, CF16", fixes,
    "7.0.0.0, 7.0.0.2, CF29", fixes,
    "6.1.5.0, 6.1.5.3, CF27", fixes,
    "6.1.0.0, 6.1.0.6, CF27", fixes
 ),
  severity:SECURITY_WARNING,
  xss: TRUE
);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(83872);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/22");

  script_cve_id(
    "CVE-2015-0493",
    "CVE-2015-1886",
    "CVE-2015-1899",
    "CVE-2015-1908",
    "CVE-2015-1917",
    "CVE-2015-1921",
    "CVE-2015-1943",
    "CVE-2015-1944"
  );
  script_bugtraq_id(
    74134,
    74173,
    74216,
    74218,
    74705
  );
  script_xref(name:"EDB-ID", value:"36788");

  script_name(english:"IBM WebSphere Portal 8.5.0 < 8.5.0 CF06 Multiple Vulnerabilities");
  script_summary(english:"Checks for the installed patch.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has web portal software installed that is
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of IBM WebSphere Portal installed on the remote host is
8.5.0 prior to 8.5.0 CF06. It is, therefore, affected by multiple
vulnerabilities :

  - An buffer overflow flaw exists in the Outside In Filters
    subcomponent due to 'ibpsd2.dll' not properly validating
    user-supplied input in PSD files. An attacker can
    exploit this to cause a denial of service or possibly
    execute arbitrary code. (CVE-2015-0493)

  - An unspecified flaw exists in the Remote Document
    Conversion Service (DCS) that allows a remote attacker
    to cause a denial of service. (CVE-2015-1886)

  - A flaw exists when handling a specially crafted request
    that allows a remote attacker to use too many available
    resources, resulting in a denial of service.
    (CVE-2015-1899)

  - A flaw exists that allows a reflected cross-site
    scripting attack due to a failure to validate input
    before returning it back to the user. A remote attacker,
    using a crafted URL, can exploit this to execute code
    or HTML within the user's browser. (CVE-2015-1908,
    CVE-2015-1944)

  - A cross-site scripting vulnerability exists in the
    Active Content Filtering component due to improperly
    validating user-supplied input. A remote attacker can
    exploit this by creating a specially crafted URL
    designed to execute script code in the victim's web
    browser. (CVE-2015-1917)

  - A flaw exists that allows a cross-site redirection
    attack due to a failure to validate certain unspecified
    input before returning it to the user. An attacker,
    using specially crafted URL, can exploit this to
    redirect victims to a website of the attacker's own
    choosing. (CVE-2015-1921)

  - An unspecified flaw exists that is trigged when handling
    Portal requests. A remote attacker can exploit this to
    cause a consumption of CPU resources, resulting in a
    denial of service condition. (CVE-2015-1943)");
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg24037786");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM WebSphere Portal 8.5.0 Cumulative Fix 06 (CF06) or
later. Refer to the IBM advisory for more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-1921");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_portal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("websphere_portal_installed.nbin");
  script_require_keys("installed_sw/IBM WebSphere Portal");

  exit(0);
}

include("websphere_portal_version.inc");

websphere_portal_check_version(
  ranges:make_list("8.5.0.0, 8.5.0.0"),
  fix:"CF06",
  severity:SECURITY_WARNING,
  xss:TRUE
);