Vulnerability Description
IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Tivoli Federated Identity Manager | 6.1.1 |
| Ibm | Tivoli Federated Identity Manager Business Gateway | 6.1.1 |
Related Weaknesses (CWE)
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23448
- http://www-01.ibm.com/support/docview.wss?uid=swg21612612PatchVendor Advisory
- http://www.securityfocus.com/bid/55732
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV23448
- http://www-01.ibm.com/support/docview.wss?uid=swg21612612PatchVendor Advisory
- http://www.securityfocus.com/bid/55732
FAQ
What is CVE-2012-3314?
CVE-2012-3314 is a vulnerability with a CVSS score of 5.8 (MEDIUM). IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted m...
How severe is CVE-2012-3314?
CVE-2012-3314 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-3314?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Tivoli Federated Identity Manager, Ibm Tivoli Federated Identity Manager Business Gateway.