IBM Lotus Sametime Enterprise Meeting Server Information Leakage Vulnerability

Release date:
Updated on:

Affected Systems:
IBM Lotus Sametime 8.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2013-3985

IBM Sametime instant messaging software provides an integrated set of instant messaging services, including voice, data, and video, allowing people to more easily find and contact colleagues, customers, and business partners, and collaborate with it.

In IBM Lotus Sametime 8.5.2 8.5.2.1, Enterprise Meeting Server does not properly restrict the application of cookies. Remote attackers can exploit this vulnerability to read session variables through weak Domain variables.

<* Source: vendor

Link: http://www-01.ibm.com/support/docview.wss? Uid = swg21654355
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

IBM
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.ibm.com/support/fixcentral/
Http://www-10.lotus.com/ldd/stwiki.nsf/dx/Installing_a_meeting_server_on_AIX_Linux_Solaris_or_Windows_st852ifr1
Http://www-10.lotus.com/ldd/stwiki.nsf/dx/Updating_Sametime_8.5.2_on_AIX_Linux_Solaris_or_Windows_st852ifr1
Http://www-10.lotus.com/ldd/stwiki.nsf/dx/Installing_Sametime_8.5.2_Interim_Feature_Release_1_st852ifr1
Http://www-10.lotus.com/ldd/stwiki.nsf/dx/Installing_Sametime_8.5.2_Interim_Feature_Release_1_on_servers_running_on_WebSphere_Application_Server_st852ifr1