Security Bulletin
Summary
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 Service Refresh 2 Fix Pack 11 and earlier releases, Version 7R1 Service Refresh 3 Fix Pack 31 and earlier releases, and Version 6 Service Refresh 16 Fix Pack 21 and earlier releases provided with IBM InfoSphere streams. These issues were disclosed as part of the IBM Java SDK updates for April 2016.
IBM InfoSphere Streams is providing an IBM Java SDK update that includes fixes for security vulnerabilities. If you run Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether these vulnerabilities are applicable to your code.
Vulnerability Details
CVEID: CVE-2016-0363
DESCRIPTION: IBM SDK, Java Technology Edition contains a vulnerability in the IBM ORB implementation that may allow untrusted code running under a security manager to elevate its privileges. This vulnerability was originally reported as CVE-2013-3009.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112016 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2016-0376
DESCRIPTION: A vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager. This vulnerability was originally reported as CVE-2013-5456.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112152 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
- IBM InfoSphere Streams Version 1.2.1.0
- IBM InfoSphere Streams Version 2.0.0.4 and earlier
- IBM InfoSphere Streams Version 3.0.0.6 and earlier
- IBM InfoSphere Streams Version 3.1.0.8 and earlier
- IBM InfoSphere Streams Version 3.2.1.4 and earlier
- IBM InfoSphere Streams Version 4.0.1.1 and earlier
- IBM Streams Version 4.1.1.0 and earlier
Remediation/Fixes
NOTE: Fix Packs are available on IBM Fix Central.
- Version 4.1.1:
- Version 4.0.1:
- Version 3.2.1:
- Versions 1.2, 2.0, 3.0, and 3.1:
- For version 1.x, 2.x, 3.x IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.
IMPORTANT NOTE: If JAVA_HOME is set ensure it points to the install location of the upgraded IBM Developer Kit, Java. Applications compiled with JAVA_HOME set to a different location will need to be recompiled after JAVA_HOME has been changed. For more information on compiling with JAVA_HOME set see the Notes section on the page at the following URL: http://www-01.ibm.com/support/knowledgecenter/SSCRJU_4.0.0/com.ibm.streams.install.doc/doc/ibminfospherestreams-install-prerequisites-java-supported-sdks.html?lang=en
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
19 May 2016: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21983367