TippingPoint Zero Day Initiative

IBM Rational Quality Manager and Test Lab Manager Backdoor Account Remote Code Execution Vulnerability

ZDI-10-214: October 18th, 2010

CVSS Score

Affected Vendors

Affected Products

Vulnerability Details

This vulnerability allows remote attackers to execute code on vulnerable installations of Rational Quality Manager and Rational Test Lab Manager. Authentication is not required to exploit this vulnerability.

The flaw exists within the installation of the bundled tomcat server. The default ADMIN account is improperly disabled within 'tomcat-users.xml' An account providing manager role level access is left enabled with a default password. A remote attacker can use this vulnerability to execute arbitrary code under the context of the tomcat server.

Vendor Response

IBM states:

this issue was fixed in Version build: 1046.

The down load for the rules update is called "Apache Tomcat Weak Default Administrative Account Credentials" and is available here:
http://download4.boulder.ibm.com/sar/CMA/RAA/013m6/0/Rules-Update-749.exe It's called.

Disclosure Timeline

    2010-06-30 - Vulnerability reported to vendor
    2010-10-18 - Coordinated public release of advisory


This vulnerability was discovered by:
    AbdulAziz Hariri