【セキュリティ情報】 IBM WebSphere Message Broker および IBM Intetration Bus :　IBM JREs 6 & 7 の複数のセキュリティ脆弱性 (IBM Java SDK updates in October 2014)

Vulnerability Details

IBM WebSphere Message Broker および IBM Intetration Busで提供されているOracle　JDKをベースにしたIBM Java Runtime Environmentコンポーネントに複数のセキュリティ脆弱性が存在します。
セキュリティ脆弱性の修正を含んだOracle critical patch がリリースに伴いIBM SDKも更新されます。

WebSphere Message Broker/IBM Integration Busに影響のある脆弱性
次の脆弱性がIBM Integration Bus and WebSphere Message Broker　に影響があります。

CVE-2014-6457, CVE-2014-6558, CVE-2014-3065, CVE-2014-3566

ブローカーにでデプロイされているJavaコードによっては、以下のリストの脆弱性の影響を受けるかもしれません。

CVE-2014-6511, CVE-2014-6512, CVE-2014-6468, CVE-2014-3566

CVE-ID: CVE-2014-6457
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97148 for the current score
IBM Confidential
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVE-ID: CVE-2014-6558
DESCRIPTION: An unspecified vulnerability related to the Security component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97151 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2014-3065
DESCRIPTION: IBM Java SDK contains a vulnerability in which the default configuration for the shared classes feature potentially allows arbitrary code to be injected into the shared classes cache, which may subsequently be executed by other local users.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/93629 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:C/I:C/A:C)

CVE-ID: CVE-2014-6511
DESCRIPTION: An unspecified vulnerability related to the 2D component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97140 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2014-6512
DESCRIPTION: An unspecified vulnerability related to the Libraries component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97147 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS CVE-ID: CVE-2014-6468
DESCRIPTION: An unspecified vulnerability related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 6.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97138 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVE-ID: CVE-2014-3566
DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)


SSLv3プロトコルを可能にするような他のエリアを把握し、適切な処置（SSLv3を無効化するような）改善措置をとるために、お客様の全ての環境を見直すよう、IBMはお勧めいたします。
SSLv3　を無効化した場合、互換性の問題が生じないことを確認してくだい。


IBM SDKで修正された脆弱性
以下は、IBM SDKに含まれる脆弱性のリストです。
脆弱性の影響を受けるかどうかあなた自身のコードを評価する必要があります。詳細はReferenceセクションを参照ください。

CVE-IDs:
CVE-2014-6513 CVE-2014-6562 CVE-2014-6546 CVE-2014-6503 CVE-2014-6532 CVE-2014-4288 CVE-2014-6493 CVE-2014-6492 CVE-2014-6458 CVE-2014-6466 CVE-2014-6468 CVE-2014-6506 CVE-2014-6476 CVE-2014-6515 CVE-2014-6519 CVE-2014-6511 CVE-2014-6517 CVE-2014-6504 CVE-2014-6531 CVE-2014-6512 CVE-2014-6457 CVE-2014-6527 CVE-2014-6502 CVE-2014-6558 CVE-2014-3065 CVE-2014-3566