IBM Rational ClearQuest SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
IBM Rational ClearQuest 7.x
Unaffected system:
IBM Rational ClearQuest 8.0.0.2
IBM Rational ClearQuest 7.1.2.6
IBM Rational ClearQuest 7.1.1.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53483
Cve id: CVE-2011-1390

IBM Rational ClearQuest is a comprehensive software change and tracking management solution.

When upgrading the user database from IBM Rational ClearQuest 7.1.1 to 7.1.2.5, 8.0, and 8.0.0.1, some inputs are not properly filtered and used in SQL queries. By injecting SQL code, this vulnerability can be exploited to perform SQL queries.

<* Source: Jan Kaestle

Link: http://secunia.com/advisories/49093/
Http://www-01.ibm.com/support/docview.wss? Uid = swg21594717
Http://www-01.ibm.com/support/docview.wss? Uid = swg21594717
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

IBM
---
For this reason, IBM has released a Security Bulletin (1594717) and corresponding patches:

1594717: Security Bulletin: SQL Injection for IBM Rational ClearQuest Maintenance tool (CVE-2011-1390)

Link: http://www-01.ibm.com/support/docview.wss? Uid = swg21594717