Security Bulletin
Summary
There are multiple vulnerabilities in IBM®Runtime Environment Java™Version 7 used by IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation. These issues have been addressed in IBM Java SDK updates in April 2019.
Vulnerability Details
CVEID: CVE-2019-2699
DESCRIPTION: Oracle's JREs/JDKs on Windows ship with an old version of a Microsoft DLL which contains a vulnerability.
CVSS Base Score: 9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159791 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-2698
DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159790 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2019-2697
DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159789 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-2602
DESCRIPTION: A flaw in the java.math.BigDecimal API causes hangs when parsing certain String values. This potentially allows an attacker to inflict a denial-of-service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159698 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVEID: CVE-2019-2684
DESCRIPTION: The Java runtime's java.rmi.Registry implementation does not check access privileges correctly for some remote calls. This allows an attacker to effectively replace a number of predefined static skeleton classes with dynamic malicious skeletons.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159776 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2019-10245
DESCRIPTION: A flaw in the OpenJ9 class verifier potentially allows untrusted code to elevate its privileges and execute arbitrary code.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/160010 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
Platform Cluster Manager Version 4.2.0, 4.2.0.1, 4.2.0.2 and 4.2.1
Platform HPC Version 4.2.0 and 4.2.1
Spectrum Cluster Foundation 4.2.2
Remediation/Fixes
|
<Product |
VRMF |
APAR |
Remediation/First Fix |
|
Platform Cluster Manager Standard Edition |
4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1 |
None |
See fix below |
|
Platform Cluster Manager Advanced Edition |
4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1 |
None |
See fix below |
|
Platform HPC |
4.2.0, 4.2.1 |
None |
See fix below |
|
Spectrum Cluster Foundation |
4.2.2 |
None |
See fix below |
Platform Cluster Manager 4.2.x & Platform HPC 4.2.x & Spectrum Cluster Foundation 4.2.2
- Download IBM JRE 7.0 x86_64 from the following location: http://www.ibm.com/support/fixcentral by keyword ‘Runtimes for Java Technology’. (For POWER platform, download ppc64 version JRE tar package. The followings steps are using x86_64 as an example.)
- Copy the tar package into the management node. If high availability is enabled, copy the JRE tar package to standby management node, as well.
- If high availability is enabled, shutdown standby management node to avoid triggering high availability.
- On the management node, stop GUI and PERF services
# pcmadmin service stop --group ALL
- On management node, extract new JRE files and replace some old folders with new ones.
# chmod +x ibm-java-x86_64-jre-7.0-10.45.bin
# ./ibm-java-x86_64-jre-7.0-10.45.bin
# mv /opt/pcm/jre/bin /opt/pcm/jre/bin-old
# mv /opt/pcm/jre/lib /opt/pcm/jre/lib-old
# mv /opt/pcm/jre/plugin /opt/pcm/jre/plugin-old
# cp -r ibm-java-x86_64-70/jre/bin /opt/pcm/jre/
# cp -r ibm-java-x86_64-70/jre/lib /opt/pcm/jre/
# cp -r ibm-java-x86_64-70/jre/plugin /opt/pcm/jre/
# mv /opt/pcm/web-portal/jre/linux-x86_64/bin /opt/pcm/web-portal/jre/linux-x86_64/bin-old
# mv /opt/pcm/web-portal/jre/linux-x86_64/lib /opt/pcm/web-portal/jre/linux-x86_64/lib-old
# mv /opt/pcm/web-portal/jre/linux-x86_64/plugin /opt/pcm/web-portal/jre/linux-x86_64/plugin-old
# cp -r ibm-java-x86_64-70/jre/bin /opt/pcm/web-portal/jre/linux-x86_64/
# cp -r ibm-java-x86_64-70/jre/lib /opt/pcm/web-portal/jre/linux-x86_64/
# cp -r ibm-java-x86_64-70/jre/plugin /opt/pcm/web-portal/jre/linux-x86_64/
- On management node, start GUI and PERF services
# pcmadmin service start --group ALL
- If high availability is enabled, start up standby management node, and replace bin, lib, plugin folders under /opt/pcm/web-portal/jre/linux-x86_64, on standby management node.
Workarounds and Mitigations
Get Notified about Future Security Bulletins
References
Change History
May 5, 2019 : original version created
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
17 May 2019
UID
ibm10883546