IBM Tivoli目录服务器明文存储DB2口令漏洞

受影响系统:

IBM Tivoli Directory Server 6.1

描述:

IBM Tivoli目录服务器提供了一个功能强大的轻量级目录访问协议(LDAP)身份基础架构,它是部署全面的身份管理应用程序和类似于Web服务的高级软件体系结构的基础。

如果安装过程中配置了DB2例程,则Windows平台上的Tivoli目录服务器的日志文件({install path}\IBM\LDAP\V6.1\var\ldapinst.log)中会两次出现明文的db2管理员口令:

(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, Setting System Property DB2AdminID: ldapdb2
(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, admin DN:ldapdb2
Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, Setting System Property DB2AdminPW: xxxxxxxsecret
(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, leaving queryExit :: LdapConfigDB2UseridPanel Method

(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
/ADD LINE AT LINE 13/
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
DB2.USERNAME = ldapdb2
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
/REPLACE LINE: 14/
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
DB2.PASSWORD = secret

<*来源:IBM (ncsupp@ca.ibm.com
  
  链接:
http://secunia.com/advisories/40734/
        http://www-01.ibm.com/support/docview.wss?uid=swg1IO12776
*>

建议:

厂商补丁:

IBM

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

http://www-01.ibm.com/support/docview.wss?uid=swg24027450

发表评论?

0 条评论。

发表评论