IBM TAM: Remote Directory Traversal and File Retrieval

Release Date 2006-02-03
Application IBM Tivoli Access Manager
Version 5.1.0.10
Severity High
Author Timothy D. Morgan <tmorgan(at)vsecurity (dot) com>
Vendor Status Vendor Notified, Fix Available
CVE Candidate CVE-2006-0513
Reference Original Advisory

Product Description

From IBM's Website[1][2]:

"IBM Tivoli Access Manager for e-business is an award winning, policy-based access control solution for e-business and enterprise applications that is in the leader quadrant of Gartner's Magic Quadrant. Tivoli Access Manager for e-business can help you manage growth and complexity, control escalating management costs and address the difficulties of implementing security policies across a wide range of Web and application resources."
"Tivoli Access Manager Plug-in for Web Servers enforces a high degree of security in a secure domain by requiring each client to provide proof of identity. Comprehensive network security can be provided by having Tivoli Access Manager Plug-in for Web Servers control the authentication and authorization of clients."

Vulnerability Overview

On December 1st, while conducting a penetration test of a TAM enabled web application, VSR identified a vulnerability in Tivoli Web Server Plug-in which is a component of Tivoli Access Manager (TAM). This flaw allows an authenticated attacker to retrieve files (which reside outside of the web root) from the web server on which the plug-in resides. It is possible to retrieve any file or list any directory which is readable by the web server software.

Vulnerability Details

IBM's TAM Plug-in contains a logout handler under the root web path named `pkmslogout'. This handler is designed to log out authenticated users. The handler's display template can be specified by the `filename' request parameter. The value of this parameter is intended to be the partial path to a file on the web server which contains the page template. This file path is vulnerable to directory traversal, and can be used to retrieve nearly arbitrary files from the web server hosting the TAM Plug-in.

For instance, if a vulnerable plug-in existed on the system tam.example.com, one could exploit the problem by hitting a URL such as:

  http://tam.example.com/pkmslogout?filename=../../../../../../../etc/passwd

It appears this problem can only be triggered when the attacker is already authenticated through the Web Plug-in.

Vendor Response

IBM was first notified on 2005-12-05. Initial response was received on 2005-12-06. A patch for this issue was released (For versions 5.1.0) on 2006-01-18 and was published as a Limited availability fix:
  5.1.0-TIV-WPI-LA0016

A generally available fix pack for version 5.1.0 and 6.0 was released by the vendor on 2006-02-03:

Fixpack 5.1.0-TIV-WPI-FP0017 is available at:
http://www-1.ibm.com/support/docview.wss?uid=swg24011562

Fixpack 6.0.0-TIV-WPI-FP0001 is available at:
http://www-1.ibm.com/support/docview.wss?uid=swg24011561 .

Recommendation

Apply the relevant fix packs available from IBM.

Common Vulnerabilities and Exposures (CVE) Information

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-0513 to this issue. This is a candidate for inclusion in the CVE list, which standardizes names for security problems.


1. IBM Tivoli Access Manager for e-business - Product overview
http://www-306.ibm.com/software/tivoli/products/access-mgr-e-bus/
2. IBM Tivoli Access Manager Plug-in for Web Servers Authentication
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.itame2.doc_5.1/am51_webservers_guide26.htm

Greetings to:
Hotsauce, Beans, and Cornbread


Copyright 2006 Virtual Security Research, LLC. All rights reserved.

2014-09-17
Apple iOS / OSX: Foundation NSXMLParser XXE Vulnerability

2014-05-20
XML Schema, DTD, and Entity Attacks

2013-06-19
IBM WebSphere Commerce: Encrypted URL Parameter Vulnerable to POA

2012-10-23
Timothy D. Morgan presents No Crack Required: Cryptanalysis in Real-World Applications at OWASP AppSecUSA 2012.

more...

Contact us by phone,
fax or e-mail:

Phone: 617.933.8919
Fax: 617.933.8920
Email: inquiry@vsecurity.com