[SingCERT] IBM WebSphere Application Server ‘Requires SSL’ Option Security Bypass Vulnerability

Last Updated on Monday, 08 February 2010 11:54

[ Summary ]

IBM WebSphere Application Server (WAS) is prone to a security-bypass vulnerability because it fails to properly detect the 'Requires SSL' option for Single Sign-on (SSO).

[ Impact Analysis ]

Successful exploits may allow attackers to bypass certain security restrictions, which may lead to other attacks.

[ Solution/Workaround ]

• The vendor has released updates. Please see the references for details.

[ Reference ]

• http://www-01.ibm.com/support/docview.wss?uid=swg21417839