Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2012.0937 Multiple vulnerabilities in IBM Rational Synergy 2 October 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Rational Synergy Publisher: IBM Operating System: AIX HP-UX Linux variants Solaris Windows Impact/Access: Modify Arbitrary Files -- Remote with User Interaction Denial of Service -- Remote/Unauthenticated Cross-site Scripting -- Remote with User Interaction Unauthorised Access -- Remote with User Interaction Reduced Security -- Unknown/Unspecified Resolution: Patch/Upgrade CVE Names: CVE-2012-2161 CVE-2012-2159 CVE-2012-0507 CVE-2012-0506 CVE-2012-0505 CVE-2012-0503 CVE-2012-0502 CVE-2012-0501 CVE-2012-0500 CVE-2012-0499 CVE-2012-0498 CVE-2012-0497 CVE-2011-5035 CVE-2011-4461 CVE-2011-3563 Reference: ASB-2012.0024.2 ESB-2012.0926 ESB-2012.0915 Original Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21612331 http://www-01.ibm.com/support/docview.wss?uid=swg21612332 http://www-01.ibm.com/support/docview.wss?uid=swg21612333 Comment: This bulletin contains three (3) IBM security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- Security Bulletin: Unspecified Vulnerabilities in Rational Synergy (CVE-2012-0502,CVE-2012-0503,CVE-2012-0506,CVE-2012-0507,CVE-2011-3563, CVE-2012-0500,CVE-2012-0497,CVE-2012-0498,CVE-2012-0499,CVE-2012-0500, CVE-2012-0501,CVE-2012-0505,CVE-2011-5035) Flash (Alert) Abstract Vulnerabilities in the Java Runtime Environment (JRE) 6 update 32 and earlier component shipped with Rational Synergy may affect the security of the product. Content VULNERABILITY DETAILS: CVE ID : CVE-2012-0502 (CVSS 6.4) DESCRIPTION : Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT. References: Complete CVSS Guide CVE-2012-0502 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73193) CVE ID : CVE-2012-0503 (CVSS 7.5) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n. References: Complete CVSS Guide CVE-2012-0503 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73191) CVE ID : CVE-2012-0506 (CVSS 4.3) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA. References: Complete CVSS Guide CVE-2012-0506 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73196) CVE ID : CVE-2012-0507 (CVSS 10) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. References: Complete CVSS Guide CVE-2012-0507 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72513) CVE ID : CVE-2011-3563 (CVSS 6.4) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound. References: Complete CVSS Guide CVE-2011-3563 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73194) CVE ID : CVE-2012-0500 (CVSS 10) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. References: Complete CVSS Guide CVE-2012-0500 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73188) CVE ID : CVE-2012-0497 (CVSS 10) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. References: Complete CVSS Guide CVE-2012-0497 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73185) CVE ID : CVE-2012-0498 (CVSS 10) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. References: Complete CVSS Guide CVE-2012-0498 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73186) CVE ID : CVE-2012-0499 (CVSS 10) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. References: Complete CVSS Guide CVE-2012-0499 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73187) CVE ID : CVE-2012-0501 (CVSS 5) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect availability via unknown vectors. References: Complete CVSS Guide CVE-2012-0501 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73195) CVE ID : CVE-2012-0505 (CVSS 7.5) DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization. References: Complete CVSS Guide CVE-2012-0505 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73192) CVE ID : CVE-2011-5035 (CVSS 5) DESCRIPTION: Rational Synergy computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869. References: Complete CVSS Guide CVE-2011-5035 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72015) Affected Platforms: All Rational Synergy supported platforms Remediation: Rational Synergy 7.2.0.X users should upgrade to Rational Synergy version 7.2.0.3 (Rational Synergy 7.2.0.3) and Rational Synergy 7.1.0.X users should move to Rational Synergy version 7.1.0.6 (Rational Synergy 7.1.0.6) Workarounds: None known; apply fixes Mitigation: Must upgrade to the new Rational Synergy releases as recommended. *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash. Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. Copyright and trademark information IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml. - ------------------------------------------------------------------------------- Security Bulletin: Potential Denial of Service (DoS) security vulnerability in IBM Rational Synergy Flash (Alert) Abstract Potential Denial of Service (DoS) security vulnerability in IBM Rational Synergy due to a Java HashTable security vulnerability in Jetty (CVE-2011-4461). Content VULNERABILITY DETAILS: CVE ID: CVE-2011-4461 DESCRIPTION: IBM Rational Synergy is potentially vulnerable to Denial of Service attacks because one of its embedded components, Jetty, has a security vulnerability. The vulnerability is caused by insufficient randomization of hash data structures. A remote attacker could exploit this vulnerability to cause the consumption of CPU resources. Customers who are using IBM Rational Synergy may be impacted by this Jetty vulnerability which can cause performance or Denial of Service (DoS) issues. CVSS: CVSS Base Score: 2 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/72017 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) Affected Platforms: All Rational Synergy supported platforms Remediation: Rational Synergy 7.2.0.X users should upgrade to Rational Synergy version 7.2.0.3 (Rational Synergy 7.2.0.3) and Rational Synergy 7.1.0.X users should move to Rational Synergy version 7.1.0.6 (Rational Synergy 7.1.0.6) Workarounds: None known; apply fixes Mitigation: Must upgrade to newer version of Rational Synergy as suggested above References: Complete CVSS Guide CVE-2011-4461 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72017) *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash. Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. Copyright and trademark information IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml. - ------------------------------------------------------------------------------- Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in the Rational Synergy Help System (CVE-2012-2159, CVE-2012-2161) Flash (Alert) Abstract Some scripts in the help system used by IBM Rational Synergy are vulnerable to open redirect or cross-site scripting attacks. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-2159 DESCRIPTION: Some scripts used by the help system are vulnerable to redirects from trusted to untrusted web sites when users click a malicious link. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/74832 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVE ID: CVE-2012-2161 DESCRIPTION: Some scripts used by the help system are vulnerable to cross-site scripting attacks. An attacker could potentially exploit this vulnerability to collect user credentials or cookie data when users click a malicious link. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/74833 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) Affected Platforms: Any supported Rational Synergy Web Help platform Remediation: Upgrade to Rational Synergy version 7.2.0.3 (Rational Synergy 7.2.0.3) Workarounds: Use Rational Synergy remote help which connects to the Rational Synergy Information Center. Mitigation: Do not trust URL links to the Rational Synergy Help system given by untrusted users. Examine the URL for extra parameters and text that are not related to the Rational Synergy Web Help system. References: Complete CVSS Guide On-line Calculator V2 CVE-2012-2161 X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/74832) X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/74833) *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash. Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. Copyright and trademark information IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUGqKqO4yVqjM2NGpAQJGbA//aitrrTvxdqcbl8qJXVnpRt4gaT3kLX5I 52ChQqKEFzcUvnhWvtqYGpPswcMej9uKLVXWPHBdRMXz2YkmTozOtIoa+yNdCJzO oMb8PD4xSZIkjcVXQC3NPbD1lcu1hkUhz//w819TK8PN2dxB05tOno+0EAHmrpy9 OFq++i6205IXSnDB6XhE0kzwiFVYcG9E1xEPZ4WaSUfLXpCNpZSY1n9DQqwAYofa YM95Vb6LEF+PmkJkXbFsEHE3JfWOM3GVnp0Bw6T4h9k2GEvyS3jVdiQVZyeY+HpE 2J2BiA3Ymu3chC0oFrmvsm48fB/vcQ8LKsjdM5qYvm4JbDLCjVVh8CtcJegWN+qo uQwhLF7xG6x6GTMawITtLHPSBIpd+KAQoy1ryxOe2KoyMrOpY/tMe7HRkxp5v0U4 FmUqVjRq8UT+icnx7lYykVNE0aoNaobOW8lxr4+6ECQkJcRaECKb1+5BBfKmAelv TIJQCB+JgjKcdODzQmR+Eh8mUgjHjkzSWiQvt4xvUjaUckCaf7Gry/G0rtThfnew uL9xSVA667M9g7/208hwF8JJPAsRBKSyGqRbFC+9xeAsRRRyZG3N0e4w4qnHt+3b Su8DyCLsX5L63CIEPYLLWg86g31WgBAbLnXwt/y7+o2B2B7FZITJlxtAOhX2GuI6 UrbXUX1bcfk= =MBws -----END PGP SIGNATURE-----