Security Bulletin
Summary
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.1.1 and v4.2, which were disclosed in the Oracle July 2019 Critical Patch Update.
Vulnerability Details
CVEID: CVE-2019-4473
DESCRIPTION: Multiple binaries in IBM SDK, Java Technology Edition on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users.
CVSS Base Score: 8.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/163984 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2019-11771
DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the inclusion of unused RPATHS in AIX builds. An attacker could exploit this vulnerability to inject code and gain elevated privileges on the system.
CVSS Base Score: 8.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/163989 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
IBM Tivoli Network Manager IP Edition v4.1.1, v4.2
Remediation/Fixes
To update the Java Runtime Environment (JRE), complete the following steps.
1. Locate the appropriate IBM JRE for your operating system on the IBM Fix Central website.
AIX: IBM Java 8.5.0.40 for AIX
Linux: IBM Java 8.5.0.40 for 64-bit Linux
zLinux: IBM Java 8.5.0.40 for Linux for z/OS
2. Download version 8.0.5.40 in archive, not binary, format and install it as per following steps.
3. Back up the directory $NCHOME/precision/jre.
4. Stop all running processes of the Network Manager Core Components and Apache Storm by using the itnm_stop command.
5. Delete the contents of the $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib directory.
6. Copy the contents of the bin and lib directories from the JRE that you installed in step 2 to $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib, respectively.
7. Restart the Network Manager Core Components and Apache Storm by using the itnm_start command. To upgrade or rollback the Network Manager Core Components, restore the backup that you made in step 3. Perform the upgrade or rollback, then perform steps 4 to 7 again.
Workarounds and Mitigations
Get Notified about Future Security Bulletins
References
Change History
17 February 2020 - Initial version published.
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
17 February 2020
UID
ibm11098729