IBM Rational Directory Server Chunked Request Handling Vulnerability


Description   IBM has acknowledged a vulnerability in IBM Rational Directory Server, which can be exploited by malicious people to bypass certain security restrictions.
For more information:
SA62768
The vulnerability is reported in Tivoli-based versions 5.2 through 5.2.1_iFix005 and Apache-based versions 5.1.1 through 5.1.1.2_iFix006.
     
Vulnerable Products   Vulnerable Software:
IBM Rational Directory Server 5.x
     
Solution   Apply iFix.Tivoli-based versions 5.2.x:Apply RDS 5.2.1 iFix006.Apache-based versions 5.1.x:Apply RDS 5.1.1.2 iFix007.
     
CVE   CVE-2014-0227
     
References   http://www.ibm.com/support/docview.wss?uid=swg21699930
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
HTTP Request Smuggling : HTTP command found in header
3.2.0
HTTP Request Smuggling : Content-Length and Transfer-Encoding: chunked fields in header
3.2.0
HTTP Request Smuggling : suspicious syntax using HTTP keyword
3.2.0
HTTP Request Smuggling : multiple Content-Length fields
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2015-04-06 

 Target Type 
Server 

 Possible exploit 
Remote