Security Bulletin
Summary
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in January 2015.
Vulnerability Details
CVEID: CVE-2014-6549
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Libraries component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100141 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2014-6585
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the 2D component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100154 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CVEID: CVE-2014-6587
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Libraries component has partial confidentiality impact, partial integrity impact, and partial availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100152 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVEID: CVE-2014-6591
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the 2D component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100155 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CVEID: CVE-2014-6593
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and JRockit related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-8892
DESCRIPTION: A vulnerability in the IBM implementation of the Java Virtual Machine may, under very limited circumstances, allow untrusted code running under a security manager to bypass permission checks and view sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99011 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-0395
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100143 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0407
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Swing component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100150 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-0408
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the RMI component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100142 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0410
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and JRockit related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0412
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the JAX-WS component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100140 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0437
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100144 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
The IBM® Runtime Environment Java™ Technology Edition provided for download with Tivoli Storage Productivity Center can be installed separately is vulnerable to all CVEs as noted by the IBM Java SDK security bulletin. Review their security bulletin and evaluate your own code to determine if you are vulnerable.
Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition
'Importing HTML'. Affected Products and Versions
Tivoli Storage Productivity Center 5.2.0 through 5.2.5.1
Tivoli Storage Productivity Center 5.1.0 through 5.1.1.6
Tivoli Storage Productivity Center 4.2.0 through 4.2.2.191
Tivoli Storage Productivity Center 4.1.x
TotalStorage Productivity Center 3.3.x
The versions listed above apply to all licensed offerings of Tivoli Storage Productivity Center, including IBM SmartCloud Virtual Storage Center Storage Analytics Engine.
System Storage Productivity Center is affected if it has one of the Tivoli Storage Productivity Center versions listed above installed on it
Remediation/Fixes
The solution is to apply an appropriate Tivoli Storage Productivity Center fix maintenance for each named product and execute the manual steps listed below. The solution should be implemented as soon as practicable.
If you have downloaded and installed IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 2 or earlier from an older version of Tivoli Storage Productivity Center, you should download the updated version after applying the fix pack and reinstall IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 3 or later. Do not use the IBM JRE 1.6.0 or IBM SDK 1.6.0 links provided with the affected Tivoli Storage Productivity Center versions.
Note: It is always recommended to have a current backup before applying any update procedure.
Tivoli Storage Productivity Center V5
Apply the Tivoli Storage Productivity Center fix maintenance as soon as practicable. (See Latest Downloads.)
| Affected TPC Version | APAR | Fixed TPC Version | Availability |
| 5.2.x | IT10569 | 5.2.6 | June 2015 |
Tivoli Storage Productivity Center 5.2.6 includes:
| |||
| 5.1.x | IT10569 | 5.1.1.7 Manual update steps are required in addition to applying 5.1.1.7 and are listed below this table. | April 2015 |
Tivoli Storage Productivity Center 5.1.1.7 includes:
| |||
Additional step for Tivoli Storage Productivity Center 5.1.1.7:
Apply WebSphere Application Server 7.0 interim fix PI33407 to Tivoli Integrated Portal. See the WebSphere Application Server security bulletin for more info.
Tivoli Storage Productivity Center V4
Apply the Tivoli Storage Productivity Center fix pack as soon as practicable (See Latest Downloads.) and follow the manual steps provided.
| Affected TPC Version | APAR | Fixed TPC Version | Availability |
| 4.2.x | IT10570 | 4.2.2 FP9 (4.2.2.195) Manual update steps are required in addition to applying 4.2.2 FP9 and are listed below this table. | March 2015 |
Tivoli Storage Productivity Center 4.2.2 FP9 includes:
| |||
- Apply embedded WebSphere Application Server fix pack 6.1.0.47 to Tivoli Storage Productivity Center for Replication if you have not done so before. See Upgrade of embedded WebSphere Application Server fix pack installation procedure for IBM Tivoli Productivity Center for Replication V4.2.2.4 for directions.
- Apply WebSphere Application Server 6.1 interim fix PI33408 to update the IBM SDK for the Replication Server. See the WebSphere Application Server security bulletin for more info.
- Apply WebSphere Application Server 6.1 interim fix PI33408 to Tivoli Integrated Portal. See the WebSphere Application Server security bulletin for more info.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU
Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition
Acknowledgement
None
Change History
11 August 2015: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
19 August 2022
UID
swg21964049