Security Bulletin
Summary
An unspecified vulnerability in Oracle Java SE could allow remote attackers to impact confidentiality and integrity of XIV management traffic.
Vulnerability Details
CVE ID: CVE-2014-0411
DESCRIPTION: An unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 could allow remote attackers to impact confidentiality and integrity of XIV management traffic, as Oracle Java SE is used by XIV Management Tools.
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.0 (MEDIUM) (AV:N/AC:H/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 4.9
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: High
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification.
Affected Products and Versions
All versions of XIV Management Tools up to and including v4.3 are affected.
Remediation/Fixes
Upgrading to XIV Management Tools v4.4 will address this vulnerability.
Workarounds and Mitigations
None known, Apply XIV Management Tools v4.4 as the fix.
Get Notified about Future Security Bulletins
References
Change History
10 August 2014: Document created
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
ssg1S1004842