Security Bulletin
Summary
IBM Cognos BI Server is affected by multiple security exposures.
Vulnerability Details
VULNERABILITY DETAILS:
CVE ID: CVE-2013-2988
DESCRIPTION:
Inadequate access control: A malicious user may be able to download files from the server that they are not intended to have access to.
The attacker must be an authenticated user with Report Author privileges and must know the exact path and filename of the file attempting to be accessed.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/84010 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N)
AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1
REMEDIATION:
The recommended solution is to apply the fixes listed at http://www.ibm.com/support/docview.wss?uid=swg24035222 (10.x versions) or http://www.ibm.com/support/docview.wss?uid=swg24035585 (version 8.4.1) for your release version as soon as practical.
CVE ID: CVE-2013-2978
DESCRIPTION:
Inadequate access control: A malicious user may be able to download files from the server that they are not intended to have access to.
The attacker must be an authenticated user with Report Author privileges and must know the exact path and filename of the file attempting to be accessed.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/83971 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/S:C/P:I/N:A/N)
AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1
REMEDIATION:
The recommended solution is to apply the fixes listed at http://www.ibm.com/support/docview.wss?uid=swg24035222 (10.x versions) or http://www.ibm.com/support/docview.wss?uid=swg24035585 (version 8.4.1) for your release version as soon as practical.
CVE ID: CVE-2013-1557
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to RMI could allow a remote attacker to execute arbitrary code on the system.
CVSS:
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/83572 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1
REMEDIATION:
The recommended solution is to apply the fixes listed at http://www.ibm.com/support/docview.wss?uid=swg24035222 (10.x versions) or http://www.ibm.com/support/docview.wss?uid=swg24035585 (version 8.4.1) for your release version as soon as practical.
CVE ID: CVE-2013-0586
DESCRIPTION:
Reflective cross-site scripting (XSS) due to inadequate input validation. An attacker who can trick a legitimate user into clicking on a link the attacker creates may be able to execute scripts of their choosing. This would allow the attacker to perform actions in the context of the user.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/83380 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/AU:S/C:N/I:P/A:N)
AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1
REMEDIATION:
The recommended solution is to apply the fixes listed at http://www.ibm.com/support/docview.wss?uid=swg24035222 (10.x versions) or http://www.ibm.com/support/docview.wss?uid=swg24035585 (version 8.4.1) for your release version as soon as practical.
ACKNOWLEDGEMENT:
The vulnerability was discovered by Oren Ofer of Hacktics Advanced Security Center at Ernst & Young.
CVE ID: CVE-2013-1478
DESCRIPTION:
Unspecified vulnerability in the Java Runtime Environment (JRE) component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSS:
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81754
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1
REMEDIATION:
The recommended solution is to apply the fixes listed at http://www.ibm.com/support/docview.wss?uid=swg24035222 (10.x versions) or http://www.ibm.com/support/docview.wss?uid=swg24035585 (version 8.4.1) for your release version as soon as practical.
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21645566