IBM Support

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2016-5597 CVE-2016-5546 CVE-2016-5548 CVE-2016-5549 CVE-2016-5547 CVE-2016-2183)

Security Bulletin


Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by IBM Spectrum Control and Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in October 2016 and January 2017.

Vulnerability Details

CVEID: CVE-2016-5597
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component could allow a remote attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118071 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2016-5546
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE Java SE Embedded and Jrockit related to the Libraries component has no confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/120869 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
resulting in a high confidentiality impact using unknown attack vectors.

CVEID: CVE-2016-5548
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Libraries component could allow a remote attacker to obtain sensitive information
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/120864 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

CVEID: CVE-2016-5549
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Libraries component could allow a remote attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/120863 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

CVEID: CVE-2016-5547
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE Java SE Embedded and Jrockit related to the Libraries component could allow a remote attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/120871 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-2183
DESCRIPTION:
OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)


The IBM® Runtime Environment Java™ Technology Edition provided for download with Tivoli Storage Productivity Center, which can be installed separately, is vulnerable to all CVEs as noted by the IBM Java SDK security bulletin. Review the following security bulletins and evaluate your own code to determine if you are vulnerable.
http://www.ibm.com/support/docview.wss?uid=swg21985393 and
http://www.ibm.com/support/docview.wss?uid=swg21997194

Affected Products and Versions

IBM Spectrum Control 5.2.8 through 5.2.13
Tivoli Storage Productivity Center 5.2.0 through 5.2.7.1
Tivoli Storage Productivity Center 5.1.0 through 5.1.1.13

The versions listed above apply to all licensed offerings of IBM Spectrum Control and Tivoli Storage Productivity Center, including IBM Smart Cloud Virtual Storage Center Storage Analytics Engine.

Remediation/Fixes

The solution is to apply an appropriate Tivoli Storage Productivity Center (IBM Spectrum Control) fix maintenance for each named product and should be implemented as soon as practicable. Starting with 5.2.8, Tivoli Storage Productivity Center has been renamed to IBM Spectrum Control.

If you have downloaded and installed IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 25 or earlier from an older version of Tivoli Storage Productivity Center, you should download the updated version after applying the fix pack and reinstall IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 30 or later.

Do not use the IBM JRE 1.6.0 or IBM SDK 1.6.0 links provided with the affected Tivoli Storage Productivity Center versions. If you upgrade to IBM Spectrum Control 5.2.13 or higher, there is no new version to download and apply as the Java WebStart GUI that previously used it is no longer provided.

Note: It is always recommended to have a current backup before applying any update procedure.



IBM Spectrum Control and Tivoli Storage Productivity Center

ReleaseFirst Fixing VRM LevelLink to Fix / Fix Availability Target
5.25.2.14http://www.ibm.com/support/docview.wss?uid=swg21320822
5.15.1.1.14http://www.ibm.com/support/docview.wss?uid=swg21320822

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

None

Change History

12 June 2017 - Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SS5R93","label":"IBM Spectrum Control"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"5.2.8;5.2.9;5.2.10;5.2.11;5.2.12;5.2.13","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}},{"Product":{"code":"SS5R93","label":"IBM Spectrum Control"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"5.1;5.1.1;5.2;5.2.1;5.2.2;5.2.3;5.2.4;5.2.5;5.2.6;5.2.7","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
22 February 2022

UID

swg21998779