IBM Support

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Process Manager

Created by Jian Jin on
Published URL:
https://www.ibm.com/support/pages/node/883544
883544

Security Bulletin


Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™Version 8 used by IBM Spectrum LSF Process Manager. These issues have been addressed by IBM Java SDK updates in April 2019.

Vulnerability Details

CVEID:  CVE-2019-2699
DESCRIPTION: Oracle's JREs/JDKs on Windows ship with an old version of a Microsoft DLL which contains a vulnerability.
CVSS Base Score: 9
CVSS Temporal Score: See  https://exchange.xforce.ibmcloud.com/vulnerabilities/159791  for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID:  CVE-2019-2698
DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See  https://exchange.xforce.ibmcloud.com/vulnerabilities/159790  for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:  CVE-2019-2697 
DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See  https://exchange.xforce.ibmcloud.com/vulnerabilities/159789  for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID:  CVE-2019-2602
DESCRIPTION: A flaw in the java.math.BigDecimal API causes hangs when parsing certain String values. This potentially allows an attacker to inflict a denial-of-service.
CVSS Base Score: 7.5
CVSS Temporal Score: See  https://exchange.xforce.ibmcloud.com/vulnerabilities/159698  for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2019-2684
DESCRIPTION: The Java runtime's java.rmi.Registry implementation does not check access privileges correctly for some remote calls. This allows an attacker to effectively replace a number of predefined static skeleton classes with dynamic malicious skeletons.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159776 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2019-10245
DESCRIPTION: A flaw in the OpenJ9 class verifier potentially allows untrusted code to elevate its privileges and execute arbitrary code.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/160010 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Spectrum LSF Process Manager 10.2

Remediation/Fixes

<Product

VRMF

APAR

Remediation/First Fix

IBM Spectrum LSF Process Manager

10.2

None
  1. Download IBM JRE 8.0 from the following location: http://www.ibm.com/support/fixcentral by keyword ‘Runtimes for Java Technology’. (The followings steps are using x86_64 as an example.)
  2. Copy the tar package into the PM server host.
  3. Log on the PM server host as root, stop jfd.
    # jadmin stop
  4. On the PM server host, extract new JRE files and replace old folders with new ones.

# chmod +x ibm-java-x86_64-jre-8.0-5.35.bin

# ./ibm-java-x86_64-jre-8.0-5.35.bin
# mv /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre-old

# mkdir -p /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre
# cp -r ibm-java-x86_64-80/* /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre
# mv /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre/jre/bin /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre
# mv /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre/jre/lib /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre
# mv /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre/jre/plugin /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre

# rm -rf /opt/ppm/10.2/linux2.6-glibc2.3-x86_64/jre/jre

  1. On the PM server host, start jfd
    # jadmin start

Workarounds and Mitigations

N/A

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

May 5, 2019 : original version created

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSZSHQ","label":"IBM Spectrum LSF Process Manager"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
17 May 2019

UID

ibm10883544

Page Feedback