Security Bulletin
Summary
An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by the Apache Software Foundation and incorporated into an IBM WebSphere Application Server Liberty fixes.
Vulnerability Details
IBM Rational Directory Server Tivoli and Rational Directory Administrator are affected by the following vulnerability:
CVEID: CVE-2015-7450
DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107918 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
Rational Directory Server Tivoli version 5.2.1
Rational Directory Administrator versions 6.0.0.0, 6.0.0.1, 6.0.0.2
Remediation/Fixes
Fixes for this vulnerability are available from the Apache Software Foundation and included in WebSphere Application Server (WAS) Liberty fixes. The fixes are available on IBM Support: Fix Central.
| Product | Required WAS installation | Remediation/Fix on Fix Central |
| Rational Directory Server Tivoli 5.2.1 | 8.5.0.2 | 8.5.0.2-WS-WASProd_WLPArchive-IFPI52103.jar |
| Rational Directory Administrator 6.0.0.0, 6.0.0.1, 6.0.0.2 | 8.5.5.6 | 8556-wlp-archive-IFPI52103.jar |
To apply the fix for Rational Directory Server Tivoli 5.2.1:
Note: The vulnerability affects the Rational Directory Administrator (RDA) that ships with Rational Directory Server Tivoli.
Note: That you must upgrade to WebSphere Application Server Liberty 8.5.0.2 before applying this fix.
- Open a console and navigate to the location where you downloaded the .jar file for the fix.
- Run the command: java -jar 8.5.0.2-WS-WASProd_WLPArchive-IFPI52103.jar
The following launch options are available for the jar file:
--installLocation [LibertyRootDir]
By default the jar will look for a "wlp" directory in its current location. The default location is in the following path in the Rational Directory Server installation: WebAppsServer/WLP_<version>. For example, WebAppsServer/WLP_8.5.5.2. If your Liberty profile install location is different than "wlp" and/or it is not in the same directory as the jar, then you can use this option to change where the jar will patch. [LibertyRootDir] can either be relative to the location of the jar or an absolute file path.
--suppressInfo
Hides all messages other than confirming the patch has completed or error messages. - Stop Rational Directory Administrator.
- Start Rational Directory Administrator.
Note: By restarting Rational Directory Administrator, you are restarting the Liberty profile.
To apply the fix for Rational Directory Administrator 6.0.0.0, 6.0.0.1 or 6.0.0.2:
Note: You must upgrade to WebSphere Application Server 8.5.5.6 before applying this fix.
- Open a console and navigate to the location where you downloaded the .jar file for the fix.
- Run the command: java -jar 8556-wlp-archive-IFPI52103.jar
The following launch options are available for the jar file:
--installLocation [LibertyRootDir]
By default the jar will look for a "wlp" directory in its current location. The default location is in the following path in the Rational Directory Administrator installation: WebAppsServer/WLP_<version>. For example, WebAppsServer/WLP_8.5.5.2. If your Liberty profile install location is different than "wlp" and/or it is not in the same directory as the jar, then you can use this option to change where the jar will patch. [LibertyRootDir] can either be relative to the location of the jar or an absolute file path.
--suppressInfo
Hides all messages other than confirming the patch has completed or error messages. - Stop Rational Directory Administrator.
- Start Rational Directory Administrator.
Note: By restarting Rational Directory Administrator, you are restarting the Liberty profile.
IBM recommends that you review your entire environment to identify vulnerable releases of the open-source Apache Commons Collections and take appropriate mitigation and remediation actions.
Get Notified about Future Security Bulletins
References
Change History
*27 November 2015: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21971596