Security Bulletin
Summary
Smarter Infrastructure Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs.
Vulnerability Details
CVE IDs: CVE-2013-5456 CVE-2013-5457 CVE-2013-5458 CVE-2013-4041 CVE-2013-5375 CVE-2013-5372 CVE-2013-5843 CVE-2013-5789 CVE-2013-5830 CVE-2013-5829 CVE-2013-5787 CVE-2013-5788 CVE-2013-5824 CVE-2013-5842 CVE-2013-5782 CVE-2013-5817 CVE-2013-5809 CVE-2013-5814 CVE-2013-5832 CVE-2013-5850 CVE-2013-5838 CVE-2013-5802 CVE-2013-5812 CVE-2013-5804 CVE-2013-5783 CVE-2013-3829 CVE-2013-5823 CVE-2013-5831 CVE-2013-5820 CVE-2013-5819 CVE-2013-5818 CVE-2013-5848 CVE-2013-5776 CVE-2013-5774 CVE-2013-5825 CVE-2013-5840 CVE-2013-5801 CVE-2013-5778 CVE-2013-5851 CVE-2013-5800 CVE-2013-5784 CVE-2013-5849 CVE-2013-5790CVE-2013-5780 CVE-2013-5797 CVE-2013-5803 CVE-2013-5772
DESCRIPTION: Customers who have Java based applications, such as Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions (including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities), Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, Change and Configuration Management Database, SmartCloud Control Desk, Intelligent Building Management, or TRIRIGA for Energy Optimization are potentially impacted by these vulnerabilities, which can cause issues related to confidentiality, integrity, and availability. For additional information including the most current description and CVSS for each vulnerability, please refer to developerWorks JavaTM Technology Security Alerts.
There are a number of vulnerabilities in the IBM SDK, Java Technology Edition that affect various components. CVE-2013-5456, CVE-2013-5457 and CVE-2013-5458 allow code running under a security manager to escalate its privileges by modifying or removing the security manager. CVE-2013-4041 and CVE-2013-5375 allow code running under a security manager to access restricted classes. These vulnerabilities could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a web browser for running applets and Web Start applications.
CVE-2013-5372 is a denial of service vulnerability which could result in a complete availability impact on the affected system.
This bulletin also covers all applicable CVEs published by Oracle as part of their October 2013 Java SE Critical Patch Update. For more information please refer to Oracle's October 2013 Java SE CPU Advisory.
| CVE ID | DESCRIPTION |
| CVE-2013-3829 CVSS Base Score: 6.4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87986 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries |
| CVE-2013-4041 CVSS Base Score: 6.8 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86416 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Unspecified vulnerability in IBM Java SDK could allow access to restricted classes. This vulnerability could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a Web browser for running Applets and Web Start applications |
| CVE-2013-5372 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86662 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P) | Unspecified vulnerability in the JRE component allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities |
| CVE-2013-5375 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86902 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Unspecified vulnerability in IBM Java SDK could allow access to restricted classes. This vulnerability could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a Web browser for running Applets and Web Start applications |
| CVE-2013-5456 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88255 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C) | Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager |
| CVE-2013-5457 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88256 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C) | Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager |
| CVE-2013-5458 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88257 CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C) | Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager |
| CVE-2013-5772 CVSS Base Score: 2.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88007 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/H:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to jhat |
| CVE-2013-5774 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87999 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Libraries |
| CVE-2013-5776 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87992 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
| CVE-2013-5778 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87990 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE allows remote attackers to affect confidentiality via unknown vectors related to 2D |
| CVE-2013-5780 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88001 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
| CVE-2013-5782 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87960 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
| CVE-2013-5783 CVSS Base Score: 6.4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87987 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing |
| CVE-2013-5784 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88005 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to SCRIPTING |
| CVE-2013-5787 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87967 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
| CVE-2013-5788 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87966 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
| CVE-2013-5789 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87968 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
| CVE-2013-5790 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88004 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to BEANS |
| CVE-2013-5797 CVSS Base Score: 3.5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88006 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/S:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote authenticated users to affect integrity via unknown vectors related to Javadoc |
| CVE-2013-5800 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88002 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to JGSS |
| CVE-2013-5801 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87991 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to 2D |
| CVE-2013-5802 CVSS Base Score: 7.5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87982 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/P) | Unspecified vulnerability in JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP |
| CVE-2013-5803 CVSS Base Score: 2.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88008 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/H:Au/N:C/N:I/N:A/P) | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to JGSS |
| CVE-2013-5804 CVSS Base Score: 6.4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87984 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc |
| CVE-2013-5809 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87962 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
| CVE-2013-5812 CVSS Base Score: 6.4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87985 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/P) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment |
| CVE-2013-5814 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87964 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA |
| CVE-2013-5817 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87969 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI |
| CVE-2013-5818 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87993 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
| CVE-2013-5819 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87994 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
| CVE-2013-5820 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87996 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to JAX-WS |
| CVE-2013-5823 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87989 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/N:A/P) | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via unknown vectors related to Security |
| CVE-2013-5824 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87965 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
| CVE-2013-5825 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87988 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/N:A/P) | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to JAXP |
| CVE-2013-5829 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87963 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
| CVE-2013-5830 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87961 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries |
| CVE-2013-5831 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87995 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
| CVE-2013-5832 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87972 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
| CVE-2013-5838 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87979 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries |
| CVE-2013-5840 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87998 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
| CVE-2013-5842 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87970 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries |
| CVE-2013-5843 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87971 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
| CVE-2013-5848 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88000 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
| CVE-2013-5849 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88003 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to AWT |
| CVE-2013-5850 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87973 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries |
| CVE-2013-5851 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87997 CVSS Environmental Score*: Undefined CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N) | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to JAXP |
The developerWorks JavaTM Technology Security Alerts includes a link to Oracle's October 2013 Critical Patch Update.
Affected Products and Versions
The following IBM Java versions are affected:
· IBM SDK Java Technology Edition Version 7***
· IBM SDK Java Technology Edition Version 6
· IBM SDK Java Technology Edition Version 5
· IBM SDK Java Technology Edition Version 1.4.2
Note that the following Oracle Java versions, which are not IBM products, are affected: Java SE JDK and JRE Version 7 Update 7 and earlier, Java SE JDK and JRE Version 6 Update 35 and earlier, Java SEJDK and JRE Version 5 Update 36 and earlier, and Java SE JDK and JRE Version 1.4.2_38 and earlier.
IBM supplied the Java Runtime Environment (JRE) from the IBM SDK Java Technology Edition Versions with the following:
The 7.1.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.
The 7.2.x versions of Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.
The 7.5.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, and SmartCloud Control Desk bundled the JRE from IBM SDK Java Technology Edition Version 6.
Intelligent Building Management 1.1.x and TRIRIGA for Energy Optimization 1.1.x bundled the JRE from IBM SDK Java Technology Edition Version 6.
It is likely that earlier unsupported versions are also affected by these vulnerabilities. Remediation is not provided for product versions that are no longer supported. IBM recommends that customers running unsupported versions upgrade to the latest supported version of products in order to obtain remediation for the vulnerabilities.
***Please note that the versions of the IBM products listed above do not bundle JRE Version 7 or IBM SDK Java Technology Edition Version 7; however, JRE Version 7 and IBM SDK Java Technology Edition Version 7 are listed here because JRE Version 7 is prevalent on the browser and therefore can potentially impact access to these IBM product versions
Remediation/Fixes
VENDOR FIXES:
There are two areas where the vulnerabilities in the Java SDK/JDK or JRE may require remediation:
1. Application Server – Update the Websphere Application Server. Refer to JDK Fixes for Websphere Application Server for additional information on updating and maintaining the JDK component within Websphere. Customers with Oracle Weblogic Server, which is not an IBM product and is not shipped by IBM, will also want to update their server.
2. Browser Client - Update the Java plug-in used by the browser on client systems, using the remediated JRE version referenced on developerWorks JavaTM Technology Security Alerts or referenced on Oracle’s latest Critical Patch Update (which can be accessed via developerWorks JavaTM Technology Security Alerts). Updating the browser Java plug-in may impact some applets such as Maximo Asset Management Scheduler. Download from IBM FixCentral the latest Maximo Asset Management Scheduler Interim Fix for Version 7.1 or the latest Maximo Asset Management Fix Pack for Version 7.5, which includes the resolution for APAR IV11560.
Due to the threat posed by a successful attack, IBM strongly recommends that customers apply fixes as soon as possible.
Workarounds and Mitigations
Until you apply the fixes, it may be possible to reduce the risk of successful attack by restricting network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from unprivileged users may help reduce the risk of successful attack. Both approaches may break application functionality, so IBM strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.
Get Notified about Future Security Bulletins
References
On-line Calculator V2
Oracle October 2013 Java SE Critical Patch Update Advisory
IBM SDK, Java Technology Edition Security Alerts
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.
Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
RELATED INFORMATION:
ACKNOWLEDGEMENTS:
The vulnerabilities described by the following CVEs were reported to IBM by Adam Gowdiak of Security Explorations: CVE-2013-5456, CVE-2013-5457, and CVE-2013-5458.
| Change History | |
| 13 Dec 2013 | Flash published |
CROSS REFERENCE INFORMATION:
| Segment | Product | Component/Platform | Version |
| Systems and Asset Management | Maximo Asset Management | All | 7.1.1.0 – 7.1.1.12 7.5.0.0 – 7.5.0.5 |
| Systems and Asset Management | Maximo Asset Management Essentials | All | 7.1.1.0 – 7.1.1.12 7.5.0.0 – 7.5.0.5 |
| Systems and Asset Management | Maximo Asset Management for Energy Optimization | All | 7.1.0.0 – 7.1.1.0 |
| Systems and Asset Management | Maximo for Government | All | 7.1.0.0 7.5.0.0 |
| Systems and Asset Management | Maximo for Nuclear Power | All | 7.1.0.0 – 7.1.1.0 7.5.0.0 – 7.5.1.0 |
| Systems and Asset Management | Maximo for Transportation | All | 7.1.0.0 – 7.1.1.0 7.5.0.0 – 7.5.1.0 |
| Systems and Asset Management | Maximo for Life Sciences | All | 7.1.0.0 – 7.1.2.0 7.5.0.0 |
| Systems and Asset Management | Maximo for Oil and Gas | All | 7.1.0.0 – 7.1.2.0 7.5.0.0 – 7.5.1.0 |
| Systems and Asset Management | Maximo for Utilities | All | 7.1.0.0 – 7.1.2.0 7.5.0.0 |
| Systems and Asset Management | Tivoli Service Request Manager | All | 7.1.0.0 – 7.1.1.12 7.2.0.0 – 7.2.1.3 |
| Systems and Asset Management | Tivoli Asset Management for IT | All | 7.1.0.0 – 7.1.1.12 7.2.0.0 – 7.2.2.1 |
| Systems and Asset Management | Change and Configuration Management Database | All | 7.1.0.0 – 7.1.1.12 7.2.0.0 – 7.2.1.2 |
| Systems and Asset Management | Intelligent Building Management | All | 1.1.0.0 |
| Systems and Asset Management | TRIRIGA for Energy Optimization | All | 1.1.0.0 |
| Systems and Asset Management | SmartCloud Control Desk | All | 7.5.0.0 – 7.5.1.1 |
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
21 September 2022
UID
swg21660039