Security Bulletin: Multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 affect IBM Flex System Manager (FSM) SMIA Configuration Tool.
Security Bulletin: Multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 affect IBM Flex System Manager (FSM) SMIA Configuration Tool.
Security Bulletin: Multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 affect IBM Flex System Manager (FSM) SMIA Configuration Tool.
Summary
There are multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 that is used by IBM Flex System Manager (FSM) SMIA Configuration Tool. These issues were disclosed as part of the Oracle updates in October 2014 and January 2015.
Vulnerability Details
CVE-ID: CVE-2015-0410
Description: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100151
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE-ID: CVE-2014-6593
Description: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100153
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVE-ID: CVE-2014-3566
Description: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and calculate the plaintext of secure connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97013
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVE-ID: CVE-2014-6468
Description: An unspecified vulnerability related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 6.9
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97138
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVE-ID: CVE-2014-6517
Description: An unspecified vulnerability in Oracle Java SE and JRockit related to the JAXP component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97145
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVE-ID: CVE-2014-6512
Description: Oracle Java SE and JRockit could allow a remote attacker to bypass security restrictions, caused by the failure to perform source address checks for packets received on a connected socket by the DatagramSocket implementation in OpenJDK. An attacker could exploit this vulnerability to process packets as if they were received from the expected source.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97147
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVE-ID: CVE-2014-6457
Description: An unspecified vulnerability in Oracle Java SE and JRockit related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97148
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVE-ID: CVE-2014-6558
Description: An unspecified vulnerability related to the Security component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97151
for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Affected products and versions
- Flex System Manager 1.1.x.x
- Flex System Manager 1.2.0.x
- Flex System Manager 1.2.1.x
- Flex System Manager 1.3.0.x
- Flex System Manager 1.3.1.x
- Flex System Manager 1.3.2.x
Remediation/Fixes
IBM recommends updating the Flex System Manager (FSM) SMIA using the instructions referenced in the table below.
Product | VRMF | APAR | SMIA Remediation |
---|---|---|---|
Flex System Manager | 1.3.3.x | IT10005 | fsmfix1.3.3.0_IT10005 |
Flex System Manager | 1.3.2.x | IT10005 | fsmfix1.3.2.0_IT10005 |
Flex System Manager | 1.3.1.x | IT10005 | fsmfix1.3.1.0_IT10005 |
Flex System Manager | 1.3.0.x | IT10005 | Upgrade to FSM 1.3.2.0 and follow the appropriate remediation for all vulnerabilities, or contact IBM Support and refer to this APAR to obtain a limited availability FSM SMIA fix for version 1.3.0.x. |
You should verify applying this configuration change does not cause any compatibility issues.
Workarounds and Mitigations
None.
Reference
- Complete CVSS Guide
- On-line Calculator V2
- IBM Java SDK Security Bulletin — Jan 2015
- IBM Java SDK Security Bulletin — Oct 2014
Related Information
IBM
Secure Engineering Web Portal
IBM Product Security
Incident Response Blog
Acknowledgement
None.
Change History
05 May 2015: Original Copy Published
29 July 2015: Updated APAR and SMIA Remediation locations
* The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.