Security Bulletin: Rational Synergy can be affected by a vulnerabilities in JSSE components (CVE-2013-0440, CVE-2013-0443, CVE-2013-1571, CVE-2013-0169)

Vulnerability Details

Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information (requires login with your IBM ID)

CVEID: CVE-2013-0440

Description: Unspecified vulnerability in Java Runtime Environment allows remote attackers to affect availability via vectors related to JSSE.

CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81799
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)


CVEID: CVE-2013-0443

Description: Unspecified vulnerability in Java Runtime Environment allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81801
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)


CVEID: CVE-2013-0169

Description: The TLS protocol does not properly consider timing side-channel attacks, which allows remote attackers to conduct distinguishing attacks and plain-text recovery attacks via
statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81902
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)


CVEID: CVE-2013-1571

Description: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the documentation
which injects arbitrary content into the main frame. The injected content appears to originate from the site hosting the documentation, but in fact it is hosted elsewhere, and may
contain malicious links or content. This type of attack is known as "clickjacking".
The attack does not require authentication and may be exploited remotely if the html page is network available, but some degree of specialized knowledge and techniques are required. An
exploit would not impact the confidentiality of information or the availability of the system, but data integrity could be compromised.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/84715 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)