IBM Support

Security Bulletin: Vulnerability in IBM Java SDK affects IMS™ Enterprise Suite: Explorer for Development (CVE-2018-1656, CVE-2018-12539)

Created by Will Li on
Published URL:
https://www.ibm.com/support/pages/node/732027
732027

Security Bulletin


Summary

There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.15 and earlier that is used by IMS™ Enterprise Suite: Explorer for Development. This issue was disclosed as part of the IBM Java SDK updates in July 2018.

Vulnerability Details

CVE-2018-1656 (CVSS 7.4)

Description

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.

The fix ensures that malicious zip files are handled gracefully.

 

CVE-2018-12539 (CVSS 8.4)

Description

The IBM Java Runtime Environment's Late Attach mechanism can be compromised by an attacker with access to the same local environment as the target JVM. The attack allows arbitrary code to be injected.

Various security enhancements ensure that the Late Attach mechanism cannot be compromised in this way.

Affected Products and Versions

Explorer for Development of the IMS™ Enterprise Suite Versions 3.3.1 and earlier.

Remediation/Fixes

Product

VRMF

APAR

Download URL

IMS Enterprise Suite Explorer for Development V3.3

 

3.3.1.10

 

N/A

 

https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/

IMS Enterprise Suite Explorer for Development V3.2

 

           3.2.1.16

 

N/A

 

https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

19 October 2018: Original version published.
26 October 2018: Updated with version 3.2.1.16.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSGMWY","label":"IBM IMS Enterprise Suite for z\/OS"},"Component":"IMS\u2122 Enterprise Suite: Explorer for Development","Platform":[{"code":"PF033","label":"Windows"}],"Version":"3.3.1, 3.2","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}}]

Document Information

Modified date:
01 June 2022

UID

ibm10732027

Page Feedback