CVE-2006-6607 Information disclosure in n/a
Local attackers can obtain the Java Key Store password by inspecting process command line arguments in IBM Tivoli Identity Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-6607?
CVE-2006-6607 is a low-severity vulnerability in n/a, published on 18 Dec 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Java Key Store (JKS) for WebSphere Application Server (WAS) for IBM Tivoli Identity Manager (ITIM) 4.6 places the JKS password in a -Djavax.net.ssl.trustStorePassword command line argument, which allows local users to obtain the password by listing the process or using other methods.
Which versions are affected by CVE-2006-6607?
It affects 1 product.
Products include Ibm Tivoli Identity Manager.
How do I fix CVE-2006-6607?
No fix has been published for CVE-2006-6607 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-6607 being exploited?
There is no known exploitation of CVE-2006-6607 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f6j9-c274-5x52.