Security Bulletin
Summary
Vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 used by WebSphere Service Registry and Repository and WebSphere Service Registry and Repository Studio. These issues were disclosed as part of the IBM Java SDK updates in January 2020.
These issues are also addressed by WebSphere Application Server Network Deployment shipped with WebSphere Service Registry and Repository.
Vulnerability Details
CVEID: CVE-2019-4732
DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172618 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H)
Affected Products and Versions
WebSphere Service Registry and Repository V8.5 and WebSphere Service Registry and Repository Studio V8.5 are affected.
Remediation/Fixes
For all releases of WebSphere Service Registry and Repository Studio, upgrade to WebSphere Service Registry and Repository Studio V8.5.6.2_IJ22492
For WebSphere Service Registry and Repository the issues are addressed by WebSphere Application Server. Refer to the following security bulletin for vulnerability details and information about fixes addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository:
Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server January 2020 CPU
Note the following Flash before upgrading WebSphere Application Server:
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
6 February 2020: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
06 February 2020
UID
ibm11379229