IBM Support

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.12

Created by Brenda Fanning on
Published URL:
https://www.ibm.com/support/pages/node/539491
539491

Security Bulletin


Summary

Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server, IBM WebSphere Application Server Hypervisor, WebSphere Application Server Liberty Profile and IBM HTTP Server.

Vulnerability Details

CVEID: CVE-2015-1936
DESCRIPTION: IBM WebSphere Application Server Administrative console could allow a remote authenticated attacker to hijack a user's session when Security is not enabled. An attacker could exploit this vulnerability using the JSESSIONID parameter to gain access to another user's session.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103108 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

  • Version 8.5 Full Profile
  • Version 8


    • Remediation/Fixes:     The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.

    Fix:
    Apply an Interim Fix , Fix Pack or PTF containing this APAR PI37230, as noted below:


    For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition:

    For V8.5.0.0 through 8.5.5.5:
  • Apply Fix Pack 6 (8.5.5.6), or later.

    • -- OR
  • Apply Interim Fix PI37230


    • For V8.0.0.0 through 8.0.0.11:
  • Apply Fix Pack 12 (8.0.0.12), or later.

    • -- OR
  • Apply Interim Fix PI37230


    • Workaround(s):     None known
    Mitigation(s):     None known

    Refer to Security bulletins already published:
    PI42928 Security bulletin for IBM HTTP Server HTTP request smuggling
    PI44793 Security bulletin for IBM HTTP Server Stack Buffer overflow
    PI44809 Security bulletin for IBM HTTP Server Denial of Service
    PI45266 HTTP Response splitting attack in WebSphere Application Server
    PI45596 Security bulletin for IBM HTTP Server Denial of Service
    PI49272 Cross-site scripting vulnerability in IBM WebSphere Application Server
    PI50993 Apache HTTPComponents vulnerabilities in IBM WebSphere Application Server
    PI52103 Vulnerability in Apache Commons affects IBM WebSphere Application Server
    PI52395 Vulnerabilities in GSKIT component used by IBM HTTP Server

    Get Notified about Future Security Bulletins

    Subscribe to My Notifications to be notified of important product support alerts like this.

    Important Note

    IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

    References

    Complete CVSS v2 Guide
    On-line Calculator v2

    Complete CVSS v3 Guide
    On-line Calculator v3

    Off

    Related Information

    IBM Secure Engineering Web Portal
    IBM Product Security Incident Response Blog

    Change History

    01 Februrary 2016: original document published

    *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

    Disclaimer

    Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

    [{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"General","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF012","label":"IBM i"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"8.5.5;8.5;8.0;7.0","Edition":"Base;Developer;Express;Liberty;Network Deployment","Line of Business":{"code":"LOB45","label":"Automation"}}]

    Document Information

    Modified date:
    15 June 2018

    UID

    swg21975042

    Page Feedback