IBM Tivoli目录服务器明文存储DB2口令漏洞

发布日期:2010-07-26
更新日期:2010-07-29

受影响系统:
IBM Tivoli Directory Server 6.1
描述:
--------------------------------------------------------------------------------
BUGTRAQ  ID: 42015

IBM Tivoli目录服务器提供了一个功能强大的轻量级目录访问协议(LDAP)身份基础架构,它是部署全面的身份管理应用程序和类似于Web服务的高级软件体系结构的基础。

如果安装过程中配置了DB2例程,则Windows平台上的Tivoli目录服务器的日志文件({install path}\IBM\LDAP\V6.1\var\ldapinst.log)中会两次出现明文的db2管理员口令:

(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, Setting System Property DB2AdminID: ldapdb2
(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, admin DN:ldapdb2
Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, Setting System Property DB2AdminPW: xxxxxxxsecret
(Nov 30, 2009 1:08:37 PM), Setup.product.install,
com.ibm.ldap.install.beans.LdapConfigDB2UseridPanel,
dbg, leaving queryExit :: LdapConfigDB2UseridPanel Method
...
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
/ADD LINE AT LINE 13/
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
DB2.USERNAME = ldapdb2
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
/REPLACE LINE: 14/
(Nov 30, 2009 1:09:24 PM), Setup.product.install,
com.installshield.wizardx.ascii.ModifyFile, msg2,
DB2.PASSWORD = secret

<*来源:IBM (ncsupp@ca.ibm.com
 
  链接:
        ?uid=swg1IO12776
*>

建议:
--------------------------------------------------------------------------------
厂商补丁:

IBM
---
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

?uid=swg24027450

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/wwssdz.html