IBM Support

Security Bulletin: Denial of Service with WebSphere Application Server affecting IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2014-0964)

Created by Stan Henderson on
Published URL:
https://www.ibm.com/support/pages/node/511577
511577

Security Bulletin


Summary

There is a potential denial of service with WebSphere Application Server versions 6.0.2 and 6.1. These affected versions of WebSphere Application Server are supported for use with IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway.

Vulnerability Details

CVEID:
CVE-2014-0964


DESCRIPTION:


There is a potential denial of service in IBM WebSphere Application Server versions 6.0.2 and 6.1. If you run a Heartbleed scanning tool or send specially crafted Heartbeat messages to the server, it can cause the IBM SDK for Java for WebSphere Application Server to become stuck in a processing loop resulting in high CPU usage. If enough processing loops are generated, the server may become unresponsive and require a server restart. There is no impact to confidentiality or integrity.


CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92877 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C)

Affected Products and Versions

  • IBM Tivoli Federated Identity Manager (FIM) - versions 6.2, 6.2.1, 6.2.2
  • IBM Tivoli Federated Identity Manager Business Gateway (FIMBG) – versions 6.2, 6.2.1, 6.2.2

Check your WebSphere version to determine if you are using one of the affected versions.

Remediation/Fixes

If you are running one of the affected WebSphere versions listed in the Affected Products section above, update your IBM WebSphere Application Server with the appropriate Interim Fix based on information in the WebSphere security bulletin link below.

ProductRemediation/First Fix
FIM 6.2, 6.21, 6.2.2PI16981 (For WebSphere 6.1.0.0 through 6.1.0.47)
Or
For Websphere 6.0.2.0 through 6.0.2.43, please contact customer support for Interim Fix PI17128.
FIMBG 6.2, 6.21, 6.2.2PI16981 (For WebSphere 6.1.0.0 through 6.1.0.47)
Or
For Websphere 6.0.2.0 through 6.0.2.43, please contact customer support for Interim Fix PI17128.

Workarounds and Mitigations

If customers are using Heartbleed tools to detect the OpenSSL Heartbleed vulnerability they should stop using the tool.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off
WebSphere Application Server Security Bulletin for CVE-2014-0964

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSZSXU","label":"Tivoli Federated Identity Manager"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"Not Applicable","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"},{"code":"PF010","label":"HP-UX"}],"Version":"6.2;6.2.1;6.2.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SS4J57","label":"Tivoli Federated Identity Manager Business Gateway"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"Not Applicable","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"6.2;6.2.1;6.2.2","Edition":"","Line of Business":{"code":null,"label":null}}]

Document Information

Modified date:
16 June 2018

UID

swg21674469

Page Feedback