Security Bulletin: Several Security Fixes to IBM Sametime Meeting Server. (CVE-2013-3983, CVE-2013-3978, CVE-2013-3988, CVE-2013-6742, CVE-2013-6743)

Security Bulletin


Summary

Provides fixes to several security issues in the IBM Sametime Meeting Server.

Vulnerability Details

CVE ID: CVE-2013-3978

DESCRIPTION:
The web application provides no directives regarding the caching of displayed information within the browser of proxy servers between the user and the application

CVSS:
CVSS Base Score: 1.2
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/84902 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:N/C:P/I:N/A:N)

CVE ID: CVE-2013-3983

DESCRIPTION:
Unvalidated Redirect URL in a Cookie
The value stored within a cookie is used after logon to redirect the user. This value is not suitably validated and can therefore be used for users redirection.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/84966 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)


CVE ID: CVE-2013-3988

DESCRIPTION:
The web application does not set the “X-Frame-Options” header and is therefore open to click- jacking style attacks.

CVSS:
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/84973 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVE ID: CVE-2013-6742

DESCRIPTION:
Browsers have features that will save password field content entered by users and then automatically complete password entry the next time the field are encountered. For security reasons it is better to set the auto complete feature of the browser to "off" for all password fields. The application does not do this and this is fixed by the fix provided here.

CVSS:
CVSS Base Score: 1.9
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/89858 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:N/A:N)

CVE ID: CVE-2013-6743

DESCRIPTION:
Possibility of Cross Site Scripting via stored IMG tag that is not filtered correctly.
The attacker must be authenticated in order to do the attack.

CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/89859 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Affected Products and Versions

IBM Sametime Meeting Server version 9 and 8.5.2

Remediation/Fixes

Fixes are available in the following document: "Fix is available for potential security vulnerabilities in Sametime Meeting Server" (#1663399)

Workarounds and Mitigations

None

References

Complete CVSS Guide
On-line Calculator V2
Acknowledgement

The vulnerabilities of CVEs 2013-3978, 2013-3983 and 2013-3988 were reported to IBM by Chris John Riley of R-IT Cert

Related information

Change History

5 February 2014: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Document information


More support for:

IBM Sametime
Meeting Server

Software version:

8.5.2.1, 9.0.0.1

Operating system(s):

AIX, IBM i, Linux, Windows

Software edition:

Standard

Reference #:

1662928

Modified date:

2014-05-19

Translate my page

Machine Translation

Content navigation