Vulnerability-Lookup

CNVD-2018-10165

Vulnerability from cnvd - Published: 2018-05-23

Title

IBM Worklight和Mobile Foundation弱密码漏洞

Description

IBM Worklight和Mobile Foundation都是美国IBM公司的产品。IBM Worklight是一套用于开发、测试、运行和管理移动应用程序的集成开发环境。Mobile Foundation是一套用于快速创建移动和全渠道应用的软件。 IBM Worklight和Mobile Foundation中存在安全漏洞，该漏洞源于程序未能正确的初始化伪随机数生成器并且Worklight程序使用了Java密码体系框架（JCA）。攻击者可利用该漏洞破坏加密保护机制。

Severity

低

Patch Name

IBM Worklight和Mobile Foundation弱密码漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=swg21665731

Reference

http://www-01.ibm.com/support/docview.wss?uid=swg21665731

Impacted products

Name
['IBM Worklight Consumer Edition 5.0.0', 'IBM Worklight Consumer Edition 5.0.5', 'IBM Worklight Consumer Edition 5.0.6', 'IBM Worklight Consumer Edition 6.0.0', 'IBM Worklight Enterprise Edition 5.0.0', 'IBM Worklight Enterprise Edition 5.0.5', 'IBM Worklight Enterprise Edition 5.0.6', 'IBM Worklight Enterprise Edition 6.0.0', 'IBM Mobile Foundation Consumer Edition 5.0.0', 'IBM Mobile Foundation Consumer Edition 5.0.5', 'IBM Mobile Foundation Consumer Edition 5.0.6', 'IBM Mobile Foundation Consumer Edition 6.0.0', 'IBM Mobile Foundation Enterprise Edition 5.0.0', 'IBM Mobile Foundation Enterprise Edition 5.0.5', 'IBM Mobile Foundation Enterprise Edition 5.0.6', 'IBM Mobile Foundation Enterprise Edition 6.0.0']

Name

['IBM Worklight Consumer Edition 5.0.0', 'IBM Worklight Consumer Edition 5.0.5', 'IBM Worklight Consumer Edition 5.0.6', 'IBM Worklight Consumer Edition 6.0.0', 'IBM Worklight Enterprise Edition 5.0.0', 'IBM Worklight Enterprise Edition 5.0.5', 'IBM Worklight Enterprise Edition 5.0.6', 'IBM Worklight Enterprise Edition 6.0.0', 'IBM Mobile Foundation Consumer Edition 5.0.0', 'IBM Mobile Foundation Consumer Edition 5.0.5', 'IBM Mobile Foundation Consumer Edition 5.0.6', 'IBM Mobile Foundation Consumer Edition 6.0.0', 'IBM Mobile Foundation Enterprise Edition 5.0.0', 'IBM Mobile Foundation Enterprise Edition 5.0.5', 'IBM Mobile Foundation Enterprise Edition 5.0.6', 'IBM Mobile Foundation Enterprise Edition 6.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2013-5391",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5391"
    }
  },
  "description": "IBM Worklight\u548cMobile Foundation\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Worklight\u662f\u4e00\u5957\u7528\u4e8e\u5f00\u53d1\u3001\u6d4b\u8bd5\u3001\u8fd0\u884c\u548c\u7ba1\u7406\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u3002Mobile Foundation\u662f\u4e00\u5957\u7528\u4e8e\u5feb\u901f\u521b\u5efa\u79fb\u52a8\u548c\u5168\u6e20\u9053\u5e94\u7528\u7684\u8f6f\u4ef6\u3002\r\n\r\nIBM Worklight\u548cMobile Foundation\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u521d\u59cb\u5316\u4f2a\u968f\u673a\u6570\u751f\u6210\u5668\u5e76\u4e14Worklight\u7a0b\u5e8f\u4f7f\u7528\u4e86Java\u5bc6\u7801\u4f53\u7cfb\u6846\u67b6\uff08JCA\uff09\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7834\u574f\u52a0\u5bc6\u4fdd\u62a4\u673a\u5236\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21665731",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10165",
  "openTime": "2018-05-23",
  "patchDescription": "IBM Worklight\u548cMobile Foundation\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Worklight\u662f\u4e00\u5957\u7528\u4e8e\u5f00\u53d1\u3001\u6d4b\u8bd5\u3001\u8fd0\u884c\u548c\u7ba1\u7406\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u3002Mobile Foundation\u662f\u4e00\u5957\u7528\u4e8e\u5feb\u901f\u521b\u5efa\u79fb\u52a8\u548c\u5168\u6e20\u9053\u5e94\u7528\u7684\u8f6f\u4ef6\u3002\r\n\r\nIBM Worklight\u548cMobile Foundation\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u521d\u59cb\u5316\u4f2a\u968f\u673a\u6570\u751f\u6210\u5668\u5e76\u4e14Worklight\u7a0b\u5e8f\u4f7f\u7528\u4e86Java\u5bc6\u7801\u4f53\u7cfb\u6846\u67b6\uff08JCA\uff09\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7834\u574f\u52a0\u5bc6\u4fdd\u62a4\u673a\u5236\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Worklight\u548cMobile Foundation\u5f31\u5bc6\u7801\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Worklight Consumer Edition 5.0.0",
      "IBM Worklight Consumer Edition 5.0.5",
      "IBM Worklight Consumer Edition 5.0.6",
      "IBM Worklight Consumer Edition 6.0.0",
      "IBM Worklight Enterprise Edition 5.0.0",
      "IBM Worklight Enterprise Edition 5.0.5",
      "IBM Worklight Enterprise Edition 5.0.6",
      "IBM Worklight Enterprise Edition 6.0.0",
      "IBM Mobile Foundation Consumer Edition 5.0.0",
      "IBM Mobile Foundation Consumer Edition 5.0.5",
      "IBM Mobile Foundation Consumer Edition 5.0.6",
      "IBM Mobile Foundation Consumer Edition 6.0.0",
      "IBM Mobile Foundation Enterprise Edition 5.0.0",
      "IBM Mobile Foundation Enterprise Edition 5.0.5",
      "IBM Mobile Foundation Enterprise Edition 5.0.6",
      "IBM Mobile Foundation Enterprise Edition 6.0.0"
    ]
  },
  "referenceLink": "http://www-01.ibm.com/support/docview.wss?uid=swg21665731",
  "serverity": "\u4f4e",
  "submitTime": "2018-05-02",
  "title": "IBM Worklight\u548cMobile Foundation\u5f31\u5bc6\u7801\u6f0f\u6d1e"
}

CVE-2013-5391 (GCVE-0-2013-5391)

Vulnerability from cvelistv5 – Published: 2018-04-27 16:00 – Updated: 2024-08-06 17:06

Summary

IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.0 Fix Pack 2 make it easier for attackers to defeat cryptographic protection mechanisms by leveraging improper initialization of the pseudo random number generator (PRNG) in Android and use of the Java Cryptography Architecture (JCA) by a Worklight program. IBM X-Force ID: 87128.

Severity

No CVSS data available.

CWE

Assigner

ibm

References

2 references

URL	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www-01.ibm.com/support/docview.wss?uid=swg…	x_refsource_CONFIRM

Date Public

2014-02-26 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T17:06:52.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ibm-traveler-cve20135391-weak-security(87128)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87128"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21665731"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-02-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.0 Fix Pack 2 make it easier for attackers to defeat cryptographic protection mechanisms by leveraging improper initialization of the pseudo random number generator (PRNG) in Android and use of the Java Cryptography Architecture (JCA) by a Worklight program. IBM X-Force ID: 87128."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-30T16:57:02.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "ibm-traveler-cve20135391-weak-security(87128)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87128"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21665731"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2013-5391",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.0 Fix Pack 2 make it easier for attackers to defeat cryptographic protection mechanisms by leveraging improper initialization of the pseudo random number generator (PRNG) in Android and use of the Java Cryptography Architecture (JCA) by a Worklight program. IBM X-Force ID: 87128."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ibm-traveler-cve20135391-weak-security(87128)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87128"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21665731",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21665731"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2013-5391",
    "datePublished": "2018-04-27T16:00:00.000Z",
    "dateReserved": "2013-08-22T00:00:00.000Z",
    "dateUpdated": "2024-08-06T17:06:52.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-10165

CVE-2013-5391 (GCVE-0-2013-5391)

Tags

Sightings

Nomenclature