IBM WebSphere DataPower SOA Appliances ASN.1 Handling Vulnerability

SA50072

CVE-2012-2110

27 Jul 2012

Highly Critical

Vendor Patch

From remote

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

IBM has acknowledged a vulnerability in IBM WebSphere DataPower SOA Appliances, which can be exploited by malicious people to potentially compromise a vulnerable system.

The vulnerability is caused due to an error when handling ASN.1 content.

For more information:
SA48847

The vulnerability is reported in versions prior to 3.8.2.14, prior to 4.0.1.12, and prior to 4.0.2.8.

Update to version 3.8.2.14, 4.0.1.12, or 4.0.2.8.

IBM:
http://www.ibm.com/support/docview.wss?uid=swg1IC84088