Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2015.1414 Security Bulletin: Users are not logged out of the Requirements Management (RM) application after the LTPA timeout period is reached (CVE-2015-0121) 29 May 2015 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: IBM Rational DOORS Next Generation Publisher: IBM Operating System: IBM i Linux variants Windows Impact/Access: Unauthorised Access -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2015-0121 Original Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21903761 - --------------------------BEGIN INCLUDED TEXT-------------------- Security Bulletin: Users are not logged out of the Requirements Management (RM) application after the LTPA timeout period is reached (CVE-2015-0121) Security Bulletin Document information More support for: Rational DOORS Next Generation General information Software version: 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 5.0, 5.0.1, 5.0.2 Operating system(s): IBM i, Linux, Windows Reference #: 1903761 Modified date: 2015-05-28 Summary For certain configurations of IBM Rational DOORS Next Generation or IBM Rational Requirements Composer, it is possible to obtain a configuration where users are not logged out after the IBM WebSphere LTPA timeout period expires. Vulnerability Details CVEID: CVE-2015-0121 DESCRIPTION: IBM Rational DOORS Next Generation allows a single browser client to sign into RDNG as two different users. Because of this, it is possible for one user to access pages with the other user's privileges, if both users are sharing the same browser client. CVSS Base Score: 3.5 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100419 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:L/AC:H/Au:S/C:P/I:P/A:P) Affected Products and Versions Rational Requirements Composer 3.0 - 3.0.1.6 Rational Requirements Composer 4.0 - 4.0.7 Rational DOORS Next Generation 4.0 - 4.0.7 Rational DOORS Next Generation 5.0 - 5.0.2 Remediation/Fixes The vulnerability only exists for applications that are deployed on IBM WebSphere Application Server, and which are further configured to use LTPA single sign on tokens. It is further necessary to adjust the LTPA session expiration timeout to non-default values. Please follow the instructions in this technote to ensure proper configuration of all the timeout parameters: Users are not logged out of the Requirements Management (RM) application after the LTPA timeout period is reached Workarounds and Mitigations Do not share your computer session with other users, or walk away from your computer without logging off of the RM application. Get Notified about Future Security Bulletins Subscribe to My Notifications to be notified of important product support alerts like this. Important note IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk. References Complete CVSS Guide On-line Calculator V2 Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVWfCVBLndAQH1ShLAQKxzRAAidKVoCENGNIb9fIgwNrKQk69cFb+/Fv0 wQnPhL//XxIGztHJ046b9pgG917FTGqJYPh4R83qa8g8GzK5olDOQy9Kv45Y4bPU KhzoWn9pEcn7Lp2Jrt7KipHhFBHDeRt7N7y5wY9t7HGpw2WWLx5Md0J7FV2AdOwD W6GRTpcwQ4aPvWV7tTJSYeFbg5n0iYApXUyX+An7sbgZ4bpShRdGnkLI0VTwp0lP IkYjPh2HGLN7eqRSbwGQO3qUyOV3bwnD1lFjcVRSfr8hZ+uO/eTYFElqxZUlPMHx x4o7Bnqog6yxidP/HJQqseK7nHtDNFXoAtgUtzMwFU82HHuruVvIrksaJ9ZvLXe/ PCaEvGpC+AT/CT5JigCKMnrh8ZOl1grASXRe+CvLGQNf8ZiPsPgGr1Jq6A8mC1VS 9rQWA6/FhWWL9smeWTLUYLpcKV2RKTWazvCDsezI7TtFwz38tjHeBW6LJAhVEe/o h4jsrxNyxwE23RZfgLIKYUiArJDYhmxTTAafFspgA4UmtQVeL4XOHvGBwtzNl8w4 sEgVei3zVrC7R0J37etQUH2yoSibprlfL9pkIM/NqlaATsPZov7wQXUF2nGDaknT 3dmQbOxOq15EX2kd4U2u3E5rkqStgs7tPwEepQOTdS6KPiMwakU2nVS00l2nOLsV U5EBqRATyjw= =4Png -----END PGP SIGNATURE-----