IBM Support

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center April 2015 CPU

Security Bulletin


Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in April 2015.

Vulnerability Details

CVEID: CVE-2015-0458
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to the Deployment component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 7.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102332 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0460
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102330 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0480
DESCRIPTION:
A directory traversal vulnerability in Oracle Java SE related to the Tools component and the extraction of JAR archive files could allow remote attacker to overwrite files on the system with privileges of another user.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102334 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVEID: CVE-2015-0486
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to the Deployment component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102335 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-0488
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE and Jrockit related to the JSSE component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102336 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0477
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to the Beans component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-0470
DESCRIPTION:
An unspecified vulnerability in Oracle Java SE related to the Hotspot component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102338 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-2808
DESCRIPTION:
The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to retrieve credit card data or other sensitive information. This vulnerability is commonly referred to as "Bar Mitzvah Attack".
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-1916
DESCRIPTION:
Server applications which use the IBM Java Secure Socket Extension provider to accept SSL/TLS connections are vulnerable to a denial of service attack due to an unspecified vulnerability.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101995 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)



The IBM® Runtime Environment Java™ Technology Edition provided for download with Tivoli Storage Productivity Center, which can be installed separately, is vulnerable to all CVEs as noted by the IBM Java SDK security bulletin. Review the following security bulletin and evaluate your own code to determine if you are vulnerable.
Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition
    Document link 'Importing HTML'.

Affected Products and Versions

Tivoli Storage Productivity Center 5.2.0 through 5.2.6
Tivoli Storage Productivity Center 5.1.0 through 5.1.1.6
Tivoli Storage Productivity Center 4.2.0 through 4.2.2.195
Tivoli Storage Productivity Center 4.1.x
TotalStorage Productivity Center 3.3.x

The versions listed above apply to all licensed offerings of Tivoli Storage Productivity Center, including IBM SmartCloud Virtual Storage Center Storage Analytics Engine.

System Storage Productivity Center is affected if it has one of the Tivoli Storage Productivity Center versions listed above installed on it

Remediation/Fixes

The solution is to apply an appropriate Tivoli Storage Productivity Center fix maintenance for each named product and execute the manual steps listed below. The solution should be implemented as soon as practicable.

If you have downloaded and installed IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 3 or earlier from an older version of Tivoli Storage Productivity Center, you should download the updated version after applying the fix pack and reinstall IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 4 or later. Do not use the IBM JRE 1.6.0 or IBM SDK 1.6.0 links provided with the affected Tivoli Storage Productivity Center versions.

Note:
It is always recommended to have a current backup before applying any update procedure.



Tivoli Storage Productivity Center V5
Apply the Tivoli Storage Productivity Center fix maintenance as soon as practicable. (See Latest Downloads.)
Affected TPC VersionAPARFixed TPC VersionAvailability
5.2.xIT104665.2.7August 2015
Tivoli Storage Productivity Center 5.2.7 includes:
  • IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix Pack 1
  • IBM JRE, Java Technology Edition, Version 7 Service Refresh 9 Fix Pack 10
  • WebSphere Application Server 8.0.0.10 + PI39866
5.1.xIT104665.1.1.8

Manual update steps are required in addition to applying 5.1.1.8 and are listed below this table.
July 2015
Tivoli Storage Productivity Center 5.1.1.8 includes:
  • IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 4 or later
  • IBM JRE, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 4 or later
  • WebSphere Application Server 8.0.0.10 + PI39866
  • Tivoli Integrated Portal 2.2.0.15
    • WebSphere Application Server 7.0.0.35

Additional step for Tivoli Storage Productivity Center 5.1.1.8:
Apply WebSphere Application Server 7.0 interim fix PI39867 to Tivoli Integrated Portal. See the WebSphere Application Server security bulletin for more info.


Tivoli Storage Productivity Center V4
Apply the Tivoli Storage Productivity Center fix pack as soon as practicable (See Latest Downloads.) and follow the manual steps provided.
Affected TPC VersionAPARFixed TPC VersionAvailability
4.2.xIT109674.2.2 FP10
(4.2.2.199)

Manual update steps are required in addition to applying 4.2.2 FP10 and are listed below this table.
August 2015
Tivoli Storage Productivity Center 4.2.2 FP10 includes:
  • IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 7
  • WebSphere Application Server 6.1.0.47 + PI45311
  • Tivoli Integrated Portal 1.1.1.19
    • WebSphere Application Server 6.1.0.45
Note: For Tivoli Storage Productivity Center 4.1.x and TotalStorage Productivity Center 3.3.x, IBM recommends upgrading to a fixed, supported release of the product.

Additional steps for Tivoli Storage Productivity Center 4.2.x
  1. Apply embedded WebSphere Application Server fix pack 6.1.0.47 to Tivoli Storage Productivity Center for Replication if you have not done so before. See Upgrade of embedded WebSphere Application Server fix pack installation procedure for IBM Tivoli Productivity Center for Replication V4.2.2.4 for directions.
  2. Apply WebSphere Application Server 6.1 interim fix PI45311 to update the IBM SDK for the Replication Server. See the WebSphere Application Server security bulletin for more info.
  3. Apply WebSphere Application Server 6.1 interim fix PI45311 to Tivoli Integrated Portal. See the WebSphere Application Server security bulletin for more info.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

None

Change History

31 August 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"SSNE44","label":"Tivoli Storage Productivity Center"},"Business Unit":{"code":"BU010","label":"Systems - Storage"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"5.1;5.1.1;5.2;5.2.1;5.2.2;5.2.3;5.2.4;5.2.5;5.2.6","Edition":""},{"Product":{"code":"SSBSEX","label":"Tivoli Storage Productivity Center Standard Edition"},"Business Unit":{"code":"BU010","label":"Systems - Storage"},"Component":" ","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"4.2;4.2.1;4.2.2","Edition":""},{"Product":{"code":"HWQQQ","label":"System Storage Productivity Center"},"Business Unit":{"code":"","label":""},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":""}]

Document Information

Modified date:
17 June 2018

UID

swg21965553