IBM Security Secret Server 10.7 Attribute channel accessible

Summaryinfo

A vulnerability marked as problematic has been reported in IBM Security Secret Server 10.7. Affected is an unknown function. The manipulation as part of Attribute leads to channel accessible. This vulnerability is traded as CVE-2019-4638. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in IBM Security Secret Server 10.7. It has been rated as problematic. This issue affects an unknown code. The manipulation as part of a Attribute leads to a channel accessible vulnerability. Using CWE to declare the problem leads to CWE-300. The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. Impacted is confidentiality. The summary by CVE is:

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.

The weakness was shared 01/28/2020 (Website). The advisory is shared at exchange.xforce.ibmcloud.com. The identification of this vulnerability is CVE-2019-4638 since 01/03/2019. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/29/2020). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1557 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-149490, VDB-149487, VDB-149486 and VDB-149485 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• IBM

Name

• Security Secret Server

Version

• 10.7

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion