CVE-2011-1389

Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-4135.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/47522	Vendor Advisory
http://secunia.com/advisories/47524	Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21577760	Patch Vendor Advisory
http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1
http://www.flexerasoftware.com/pl/13057.htm
http://www.zerodayinitiative.com/advisories/ZDI-11-272/
http://www.securityfocus.com/bid/49191
https://exchange.xforce.ibmcloud.com/vulnerabilities/71739

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:telelogic_license_server:2.0:::::::*
	cpe:2.3:a:ibm:rational_license_server:7.0:::::::*
	cpe:2.3:a:ibm:rational_license_key_server:8.0:::::::*
	cpe:2.3:a:ibm:rational_license_key_server:8.1:::::::*
	cpe:2.3:a:ibm:rational_license_key_server:8.1.1:::::::*
	cpe:2.3:a:ibm:rational_license_key_server:8.1.2:::::::*
	cpe:2.3:a:ibm:rational_license_server:7.5:::::::*
	cpe:2.3:a:ibm:rational_license_server:7.1:::::::*

Information

Published : 2012-01-19 11:55

Updated : 2017-08-16 18:34

NVD link : CVE-2011-1389

Mitre link : CVE-2011-1389

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

ibm

rational_license_server
telelogic_license_server
rational_license_key_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/47522", "name": "47522", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/47524", "name": "47524", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg21577760", "name": "http://www.ibm.com/support/docview.wss?uid=swg21577760", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1", "name": "http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1", "tags": [], "refsource": "MISC"}, {"url": "http://www.flexerasoftware.com/pl/13057.htm", "name": "http://www.flexerasoftware.com/pl/13057.htm", "tags": [], "refsource": "MISC"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-11-272/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-11-272/", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/49191", "name": "49191", "tags": [], "refsource": "BID"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71739", "name": "rlc-logfiles-code-execution(71739)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-4135."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-1389", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-01-19T19:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:telelogic_license_server:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_server:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_key_server:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_key_server:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_key_server:8.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_key_server:8.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_server:7.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:rational_license_server:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:34Z"}