Security Bulletin
Summary
Potential Security Exposure with IBM WebSphere MQ Telemetry 7.0.1
There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition Version 5, that is used by IBM WebSphere MQ Telemetry 7.0.1. These issues were disclosed as part of the IBM Java SDK updates between July 2014 and January 2015.
Vulnerability Details
CVEID: CVE-2014-4263
DESCRIPTION: The JSSE component's Diffie-Hellman key exchange implementation is vulnerable to a man-in-the middle attack. The fix adds a new check to prevent the attack.
This issue affects any application that uses the JSSE implementation of Diffie-Helman key exchange, either directly or via protocols such as SSL or TLS. The vulnerability applies to both client and server usage.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94606 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-4244
DESCRIPTION: If an attacker can observe local variables (temperature, RF, sound), they can deduce the RSA private key based on changes in those variables. The fix introduces "dead" computations (aka blinding) to foil these attacks.This issue affects applications which use the RSA encryption algorithm, but it is only exploitable by a local user with direct access to the environment on which the JRE is running.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94605 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0410
DESCRIPTION: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2014-6593
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Affected Products and Versions
IBM WebSphere MQ Telemetry 7.0.1
Remediation/Fixes
A fix for the IBM WebSphere MQ Telemetry 7.0.1 is available from IBM by requesting IT04335 from IBM Support.
Workarounds and Mitigations
None known
Get Notified about Future Security Bulletins
References
Change History
12 Sept 2014: Original Version Published
26 Sept 2014: Removed unnecessary reference to MQ
09 March 2015: Added two new Java vulnerabilities
16 March 2015: Updated format to match template
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21684073