Search /
Docfinder:
Advanced search  |  Help  |  Site map
RESEARCH CENTERS
SITE RESOURCES
Click for Layer 8! No, really, click NOW!
Networking for Small Business
TODAY'S NEWS
• Valentine's Day Patch Tuesday: Microsoft to issue 9 patches, 4 critical
• Mobile World Congress sneak peek: Quad-core smartphones, Ice Cream Sandwich & more
• Microsoft details 'Windows on ARM' program
• March debut of 'iPad 3' a sure bet, says analyst
•
• FBI unbolts Steve Jobs 1991 investigation file
• Cisco boosted profit, sales in Q2 while cutting costs
• Macs take on the enterprise
• Four crazy tech ideas from Google's Solve for X project
• Obama 2012 campaign playlist revealed courtesy of Spotify
• Oracle buying Taleo for US$1.9 billion in direct hit at SAP
• Amazon attacks Apple: You get 3 Kindle products for price of iPad 2
• Pre-rendered pages highlight latest Google Chrome release
• Microsoft exec: Lync-Skype integration a 'compelling opportunity'
• The future of hypervisors
•


/
Send to a friend Feedback

IBM e-commerce servers vulnerable to hacks

Related linksToday's breaking news
Send to a friendFeedback

By Agam Shah
IDG News Service, 03/08/01

IBM on Wednesday posted an advisory on its Web site that alerted customers to a tool that could potentially decrypt administrator and customer passwords residing on servers that use some IBM e-commerce software.

The tool allows a hacker to decrypt and obtain passwords from sites that utilize macros used to conduct e-commerce transactions. Passwords of administrators and shoppers could be compromised via this tool, said the advisory.

The affected IBM e-commerce servers include Net.Commerce: v3.1, v3.1.1, v3.1.2, v3.2; WebSphere Commerce Suite: v4.1, v4.1.1; Net.Commerce Hosting Server: v3.1.1, v3.1.2, v3.2; WebSphere Commerce Suite, Service Provider Edition: v3.2; and WebSphere Commerce Suite, Market Place Edition: v4.1. The vulnerability is found on versions of these servers that run on several operating systems, including IBM's AIX, Microsoft's Windows NT and Sun Microsystems' Solaris.

According to IBM's advisory, administrators first need to verify whether the site has been exposed to the tool. This involves checking the site log for the possibility of a macro exposure to the tool. If a hack is verified, the next step involves eliminating the exposure, which includes changing administrator passwords and securing the macros used to conduct e-commerce transactions. Other recommendations from IBM include changing access permissions to directories and macros.

IBM said it issued the first security alert on this topic in November 1999. Recently, however, hackers released the tool to take advantage of the existing vulnerabilities, prompting the more recent advisory.

According to the Bugtraq mailing list on computer security vulnerabilities, IBM's e-commerce platforms support macro tools that do not properly validate requests in user-supplied input. If a request to a vulnerable script is made, the server can disclose sensitive system information, including results of arbitrary queries made to the e-commerce server database, according to Bugtraq. The hack also allows a hacker to obtain higher account privileges, Bugtraq said.

The mailing list further states that WebSphere Commerce Suite Version 5.1 is not vulnerable to the hack, as it uses different macro technology.

Network World's Kathleen Ohlson contributed to this report.

Related Links

 
NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
Click here to sign up!
New Event - WANs: Optimizing Your Network Now.
Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
Attend FREE
Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.