CVE-2012-3317
medium
CVSS v3
—
CVSS v2
6.9
VIR risk
6.9
Description
IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg21611401
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | websphere_message_broker | 6.1 | |
| ibm | websphere_message_broker | 6.1.0.1 | |
| ibm | websphere_message_broker | 6.1.0.2 | |
| ibm | websphere_message_broker | 6.1.0.3 | |
| ibm | websphere_message_broker | 6.1.0.4 | |
| ibm | websphere_message_broker | 6.1.0.5 | |
| ibm | websphere_message_broker | 6.1.0.6 | |
| ibm | websphere_message_broker | 6.1.0.7 | |
| ibm | websphere_message_broker | 6.1.0.8 | |
| ibm | websphere_message_broker | 6.1.0.9 | |
| ibm | websphere_message_broker | 6.1.0.10 | |
| ibm | websphere_message_broker | 7.0. | |
| ibm | websphere_message_broker | 7.0.0.1 | |
| ibm | websphere_message_broker | 7.0.0.2 | |
| ibm | websphere_message_broker | 7.0.0.3 | |
| ibm | websphere_message_broker | 7.0.0.4 | |
| ibm | websphere_message_broker | 8.0 | |
| ibm | websphere_message_broker | 8.0.0.1 | |
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC85477
- http://www.ibm.com/support/docview.wss?uid=swg21611401
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77818
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC85477
- http://www.ibm.com/support/docview.wss?uid=swg21611401
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77818
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.