TIBCO ActiveMatrix Policy Manager/Agent vulnerabilities
Original release date: February 18, 2015
Last revised: --
Source: TIBCO Software Inc.
Systems Affected
TIBCO ActiveMatrix Policy Agent 3.0.0, 3.1.0, 3.1.1
TIBCO ActiveMatrix Policy Manager 3.0.0, 3.1.0, 3.1.1
TIBCO ActiveMatrix Management Agent for WCF 1.0.0, 1.1.0, 1.2.0
TIBCO ActiveMatrix Management Agent for WebSphere 1.0.0, 1.1.0, 1.2.0
The following components are affected:
* TIBCO ActiveMatrix Policy Manager Authentication Module
Description
The TIBCO ActiveMatrix Policy components listed above contain a critical
vulnerability which could allow privilege escalation.
TIBCO has released updated versions of the affected software products
which address these issues. TIBCO strongly recommends sites running the
affected components install the applicable update as described below.
Impact
The impact of this vulnerability may include unprivileged information disclosure.
CVSS v2 Base Score: 3.5 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Solution
For each affected system, update to the corresponding software versions:
TIBCO ActiveMatrix Policy Agent 3.1.2 or higher
TIBCO ActiveMatrix Policy Manager 3.1.2 or higher
TIBCO ActiveMatrix Management Agent for WCF 1.2.1 or higher
TIBCO ActiveMatrix Management Agent for WebSphere 1.2.1 or higher
References
http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2014-5286