How to remediate – IBM Rational License Key Server Administration and Reporting T…

1. Introduction

The IBM Rational License Key Server Administration and Reporting Tool is vulnerable due to using a default set of known login credentials. This means an attacker could gain unauthorized access to the web interface, potentially allowing them to manage license keys and disrupt service availability. Systems running this tool with default credentials are affected. A successful exploit could lead to compromise of confidentiality, integrity, and availability of licensing information.

2. Technical Explanation

• Exploit mechanism: An attacker attempts to log in to the web interface with known default credentials.
• Scope: IBM Rational License Key Server Administration and Reporting Tool.

3. Detection and Assessment

• Quick checks: Access the IBM Rational License Key Server Administration and Reporting Tool web interface and attempt to log in with default credentials (e.g., username ‘admin’, password ‘admin’).
• Scanning: Nessus plugin ID 16829 can identify this vulnerability. Other scanners may have similar checks.
• Logs and evidence: Check the application logs for successful login attempts using default credentials. The log location varies depending on installation settings, but is typically within the Rational License Key Server installation directory.

# No command available as assessment relies on web interface access.

4. Solution / Remediation Steps

The following steps provide a precise way to fix this issue. These steps are small, testable and safe to roll back.

4.1 Preparation

• There are no dependencies or pre-requisites. A rollback plan involves restoring the backed-up configuration file.
• A change window may be needed depending on business impact, and should be approved by IT management.

4.2 Implementation

1. Step 1: Log in to the IBM Rational License Key Server Administration and Reporting Tool web interface using default credentials (if possible).
2. Step 2: Navigate to the “Administration” section of the tool.
3. Step 3: Locate the user management settings.
4. Step 4: Change the password for the ‘admin’ account to a strong, unique password.
5. Step 5: Save the changes and restart the Rational License Key Server service if stopped earlier.

4.3 Config or Code Example

Before

Username: admin
Password: admin

After

Username: admin
Password: [Strong, unique password]

4.4 Security Practices Relevant to This Vulnerability

Several security practices directly address this vulnerability type.

• Practice 1: Safe defaults – Avoid using default credentials for any system or application.
• Practice 2: Least privilege – Limit user access rights to only what is necessary.

4.5 Automation (Optional)

No automation script is provided, as changing passwords requires manual interaction with the web interface.

5. Verification / Validation

• Post-fix check: Attempt to log in to the IBM Rational License Key Server Administration and Reporting Tool web interface using the original default username (‘admin’) and password (‘admin’). The login should fail.
• Re-test: Re-run the detection steps from section 3, which should no longer identify the vulnerability.
• Monitoring: Monitor application logs for failed login attempts with default credentials.

# No command available as assessment relies on web interface access.

6. Preventive Measures and Monitoring

Several measures can prevent this vulnerability type.

• Asset and patch process: Implement a regular review cycle for asset configurations to identify systems with default credentials.

7. Risks, Side Effects, and Roll Back

Changing the password may temporarily disrupt service if the correct new password is forgotten or lost. A rollback involves restoring the backed-up configuration file.

• Roll back: Restore the Rational License Key Server configuration from the backup created in step 4.1. Restart the service.

8. References and Resources

Links only to sources that match this exact vulnerability.

• Vendor advisory or bulletin: http://www.nessus.org/u?031fcf50
• NVD or CVE entry: Not applicable for this specific finding.
• Product or platform documentation relevant to the fix: IBM Rational License Key Server documentation on user management.