Security Bulletin
Summary
Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM Tivoli Network Manager IP Edition
Vulnerability Details
Tivoli Network Manager is shipped with an IBM SDK Java Technology Edition that is based on the Oracle JDK. Oracle has released April 2014 critical patch updates (CPU) which contain security vulnerability fixes. The IBM SDK for Java has been updated to incorporate these fixes plus one additional vulnerability (CVE-2014-0878) .
CVEID: CVE-2014-0878
DESCRIPTION: A vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic providers potentially allows an attacker to predict the output of the random number generator under certain circumstances. Please refer to the Workarounds & Mitigation section below for additional information.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91084 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-0460
DESCRIPTION: An unspecified vulnerability related to the JNDI component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92482 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-0453
DESCRIPTION: An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92490 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Affected Products and Versions
|
Affected Product and Version(s) | Product and Version shipped as a component |
| Tivoli Network Manager 3.8 | Bundled the TIP version 1.1.1.x, IBM WebSphere version 6.1.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 6. |
| Tivoli Network Manager 3.9 | Bundled the TIP version 2.1.0.x, IBM WebSphere version 7.0.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 7. |
| Tivoli Network Manager 4.1 | Bundled the TIP version 2.2.0.x, IBM WebSphere version 7.0.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 7. |
Remediation/Fixes
Upgrade your SDK to an interim fix level as determined below:
http://www-01.ibm.com/support/docview.wss?uid=swg21673013
Download and apply the interim fix APARs below, for your appropriate release:
For Tivoli Network Manger IP Edition 3.9 and 4.1 version, WebSphere V7.0.0.0 through 7.0.0.31:
- Apply Interim Fix PI14305: Will upgrade you to SDK 6 SR16
- Apply IBM SDK for Java shipped with WebSphere Application Server Fix pack 33 (7.0.0.33) or later (targeted to be available 23 June 2014).
For Tivoli Network Manger IP Edition 3.8 version, WebSphere For V6.1.0.0 through 6.1.0.47:
- Refer to October 2015 CPU and apply fix
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21674328