IBM Rational Quality Manager and Test Lab Manager Backdoor Account Remote Code Execution VulnerabilityZDI-10-214: October 18th, 2010
This vulnerability allows remote attackers to execute code on vulnerable installations of Rational Quality Manager and Rational Test Lab Manager. Authentication is not required to exploit this vulnerability.
The flaw exists within the installation of the bundled tomcat server. The default ADMIN account is improperly disabled within 'tomcat-users.xml' An account providing manager role level access is left enabled with a default password. A remote attacker can use this vulnerability to execute arbitrary code under the context of the tomcat server.
Vendor ResponseIBM states:
this issue was fixed in Version 18.104.22.168 build: 1046.
The down load for the rules update is called "Apache Tomcat Weak Default Administrative Account Credentials" and is available here:
http://download4.boulder.ibm.com/sar/CMA/RAA/013m6/0/Rules-Update-749.exe It's called.
2010-06-30 - Vulnerability reported to vendor
2010-10-18 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: