IBM Rational Automation Framework Web UI Security Bypass Vulnerability

IBM Rational Automation Framework Web UI Security Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
IBM Rational Automation Framework 3.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57008
CVE (CAN) ID: CVE-2012-4816

The IBM Rational Automation Framework automatically performs middleware environment building, middleware management, and deployment of applications and related artifacts. This customizable and scalable framework supports IBM WebSphere middleware, Oracle WebLogic Server, and JBoss Application Server.

When the IBM Rational Automation Framework (RAF) 3.0, 3.0.0.1, 3.0.0.2, 3.0.0.3, 3.0.0.4, and 3.0.0.5 do not correctly check the credential and access the Rational Automation Framework (RAF) Web UI through port 80/TCP, it will force the user to log on, but the user can directly access 8080/TCP (Default Application server port) to browse various root contexts until the wizard location is located.

<* Source: IBM (ncsupp@ca.ibm.com)

Link: http://secunia.com/advisories/51587/
Http://xforce.iss.net/xforce/xfdb/78379
Http://www-01.ibm.com/support/docview.wss? Uid = swg21620359
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

Environment Generation Security Patch for Tomcat

1. Modify the following file and fix Env Gen Wizard. By default, you do not need to log on to it.

Path: C: \ IBM \ Apache \ tomcat \ conf
File: tomcat-users.xml

Add a user configuration file between <tomcat-users> labels

<Role rolename = "admin"/>
<User username = "admin" password = "test123" roles = "admin"/>

2. Add the following components on the </web-app> tab.

Path: C: \ IBM \ Apache \ tomcat \ webapps \ rafw \ WEB-INF
File: Web. xml

<Security-role>
<Role-name> admin </role-name>
</Security-role>

<Security-constraint>
<Display-name> Environment Generation </display-name>
<Web-resource-collection>
<Web-resource-name> Administration </web-resource-name>
<Url-pattern>/rafw/* </url-pattern>
</Web-resource-collection>

<! -- Only administrators can access this resource -->
<Auth-constraint>
<Role-name> admin </role-name>
</Auth-constraint>
<User-data-constraint>
<Transport-guarantee> CONFIDENTIAL </transport-guarantee>
</User-data-constraint>
</Security-constraint>

<! -- Use BASIC security -->
<Login-config>
<Auth-method> BASIC </auth-method>
<Realm-name> Secure Area </realm-name>
</Login-config>

3. Restart BuildForge.

Environment Generation Security Patch for WebSphere Application Server (WAS 7.0 & 8.0)

Update the web. xml file

1. The web. xml file has two copies in the following directory:

/WAS_install_root/installedApps/<cellname>/rweb. ear/rweb. war/WEB-INF/web. xml
/WAS_install_root/config/cells/<cellname>/applications/rweb. ear/deployments/rweb. war/WEB-INF/web. xml

Note: For WebSphere Application Server Network Deployment, the following files must be updated:

/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/<dellname>/applications/rweb_war.ear/deployments/rweb_war/rweb. war/web. xml

2. Insert the following content to three web. xml files

<Security-constraint>
<Display-name> Environment Generation </display-name>
<Web-resource-collection>
<Web-resource-name> Security constraint for Env Gen </web-resource-name>
<Url-pattern>/rafw/* </url-pattern>
</Web-resource-collection>
<Auth-constraint>
<Role-name> admin </role-name>
</Auth-constraint>
<User-data-constraint>
<Transport-guarantee> CONFIDENTIAL </transport-guarantee>
</User-data-constraint>
</Security-constraint>
<Login-config>
<Auth-method> BASIC </auth-method>
</Login-config>

<Security-role>
<Role-name> admin </role-name>
</Security-role>

3. Enable WebSphere Application Server security

4. Map Security Roles in Web. xml to WAS Manage User/Group

Try to use the default WAS port to log on: http: // <server_url>: 9080/rafw/env

Vendor patch:

IBM
---
For this reason, IBM has released a Security Bulletin (swg21620359) and corresponding patches:

Swg21620359: Security Bulletin: Rational Automation Framework Environment Wizard Vulnerability (CVE-2012-4816)

Link: http://www-01.ibm.com/support/docview.wss? Uid = swg21620359