Security Bulletin
Summary
There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM License Key Server Administration and Reporting Tool (ART) and Agent.
Vulnerability Details
DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by divide-by-zero error in the alloc_sarray function in jmemmgr.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/143429 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
DESCRIPTION: An unspecified vulnerability related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/155744 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/155741 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
DESCRIPTION: Eclipse OpenJ9 is vulnerable to a buffer overflow, caused by improper bounds checking by the jio_snprintf() and jio_vsnprintf() functions. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/157512 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
DESCRIPTION: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users.
CVSS Base Score: 5.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/152081 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Affected Products and Versions
- RLKS Administration and Reporting Tool version 8.1.5
- RLKS Administration and Reporting Tool version 8.1.5.1
- RLKS Administration and Reporting Tool version 8.1.5.2
- RLKS Administration and Reporting Tool version 8.1.5.3
- RLKS Administration and Reporting Tool version 8.1.5.4
- RLKS Administration and Reporting Tool version 8.1.5.5
- RLKS Administration and Reporting Tool version 8.1.5.6
- RLKS Administration and Reporting Tool version 8.1.6
- RLKS Administration and Reporting Agent version 8.1.5
- RLKS Administration and Reporting Agent version 8.1.5.1
- RLKS Administration and Reporting Agent version 8.1.5.2
- RLKS Administration and Reporting Agent version 8.1.5.3
- RLKS Administration and Reporting Agent version 8.1.5.4
- RLKS Administration and Reporting Agent version 8.1.5.5
- RLKS Administration and Reporting Agent version 8.1.5.6
- RLKS Administration and Reporting Agent version 8.1.6
Remediation/Fixes
Replace the JRE used in IBM License Key Server Administration and Reporting Tool and IBM License Key Server Administration Agent.
Steps to replace the JRE in IBM License Key Server Administration and Reporting Tool (All Versions)
1. Go to Fix Central
2. On the Find product tab, enter Rational Licensing in the Product Selector field and hit enter.
3. Select the Installed Version and hit continue button.
4. Select the platform of the machine where RLKS Administration and Reporting Tool is installed and hit continue button.
5. On the Identify fixes page, select Browse for fixes and select Show fixes that apply to this version and hit continue button.
6. Identify and click the iFix named IBM_License_Key_Server_Administration_And_Reporting_Tool_And_Agent_816_iFix_1.
7. Download the JARs, US_export_policy.jar and local_policy.jar.
8. Download the JRE for your target platform.
9. Shutdown RLKS Administration and Reporting Tool and Agent both.
10. Go to the installation location of RLKS Administration and Reporting Tool and Agent one after the other.
11. Rename <install location>/jre folder to <install location>/jre_back. This step backs up the existing JRE.
12. Extract the downloaded JRE into some folder. From inside the extracted folder, copy the sub-folder named jre and place it inside the <install location> of both RLKS Administration and Reporting Tool and Agent.
13. Navigate to the folder jre\lib\security under the <install location> for RLKS Administration and Reporting Tool. Copy the JARs, US_export_policy.jar and local_policy.jar over there.
14. Startup RLKS Administration and Reporting Tool followed by Agent.
15. Login to the tool using rcladmin user and verify that you see the configured license servers under 'Server' tab.
Workarounds and Mitigations
Get Notified about Future Security Bulletins
References
Change History
20 May 2019: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
20 May 2019
UID
ibm10884972