Security Bulletin
Summary
There is a potential denial of service with WebSphere Application Server versions 6.0.2 and 6.1. These affected versions of WebSphere Application Server are supported for use with IBM Tivoli Security Policy Manager.
Vulnerability Details
CVEID:
CVE-2014-0964
DESCRIPTION:
There is a potential denial of service in IBM WebSphere Application Server versions 6.0.2 and 6.1. If you run a Heartbleed scanning tool or send specially crafted Heartbeat messages to the server, it can cause the IBM SDK for Java for WebSphere Application Server to become stuck in a processing loop resulting in high CPU usage. If enough processing loops are generated, the server may become unresponsive and require a server restart. There is no impact to confidentiality or integrity.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92877 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C)
Affected Products and Versions
- IBM Tivoli Security Policy Manager (TSPM) versions 7.0 and 7.1
Please check your WebSphere version to determine if you are using one of the affected versions.
Remediation/Fixes
If you are running one of the affected WebSphere versions listed in the Affected Products section above, update your IBM WebSphere Application Server with the appropriate Interim Fix based on information in the WebSphere security bulletin link below.
| Product | Remediation/First Fix |
| TSPM 7.0, 7.1 | PI16981 (For WebSphere 6.1.0.0 through 6.1.0.47) |
Workarounds and Mitigations
If customers are using Heartbleed tools to detect the OpenSSL Heartbleed vulnerability they should stop using the tool.
Get Notified about Future Security Bulletins
References
Change History
Removed the link to PI14306 because all of the out of date SDK updates have been removed and now point to the latest SDK updates since they are cumulative.
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21674463