CVEvulnerability
CVE-2014-6140
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-12-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-310
Description
IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal.
Affected configurations
• ibm tivoli endpoint manager mobile device management (<= 9.0)
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html Exploit
- http://seclists.org/fulldisclosure/2014/Dec/3 Exploit
- http://www-01.ibm.com/support/docview.wss?uid=swg21691701 Vendor Advisory
- http://www.securityfocus.com/archive/1/534131/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/71424 www.securityfocus.com
- http://www.securitytracker.com/id/1031306 www.securitytracker.com
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components Exploit
- http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html Exploit
- http://seclists.org/fulldisclosure/2014/Dec/3 Exploit
- http://www-01.ibm.com/support/docview.wss?uid=swg21691701 Vendor Advisory
- http://www.securityfocus.com/archive/1/534131/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/71424 www.securityfocus.com
- http://www.securitytracker.com/id/1031306 www.securitytracker.com
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components Exploit