Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0808
Security Bulletin: IBM QuickFile is affected by
vulnerabilities that exist in the IBM Java SDK.
11 June 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM QuickFile
Publisher: IBM
Operating System: VMware ESX Server
Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated
Delete Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-0443 CVE-2013-0440 CVE-2013-0169
Reference: ASB-2013.0025
ASB-2013.0013
Original Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg21639830
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: IBM QuickFile is affected by vulnerabilities that exist in
the IBM Java SDK.
Flash (Alert)
Document information
IBM QuickFile
Software version:
1.0
Operating system(s):
VMware ESXi
Reference #:
1639830
Modified date:
2013-06-05
Abstract
IBM QuickFile uses IBM Java SDK. Multiple security vulnerabilities exist in
the IBM Java SDK version this is shipped with the IBM QuickFile.
Content
The IBM QuickFile is shipped with an IBM Java SDK which is based on the Oracle
SDK. Oracle has released a critical patch update (CPU) which contains security
vulnerability fixes. This IBM QuickFile fix pack has an updated version of the
IBM Java SDK with these fixes.
VULNERABILITY DETAILS:
CVE ID: CVE-2013-0440
DESCRIPTION:
Unspecified vulnerability in Java Runtime Environment allows remote attackers
to affect availability via vectors related to JSSE.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81799
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE ID: CVE-2013-0443
DESCRIPTION:
Unspecified vulnerability in Java Runtime Environment allows remote attackers
to affect confidentiality and integrity via vectors related to JSSE.
CVSS Base Score: 4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81801
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVE ID: CVE-2013-0169
DESCRIPTION:
The TLS protocol does not properly consider timing side-channel attacks,
which allows remote attackers to conduct distinguishing attacks and plain-text
recovery attacks via statistical analysis of timing data for crafted packets,
aka the "Lucky Thirteen" issue.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81902
CVSS Environmental Score*: Undefined
CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
AFFECTED PRODUCTS AND VERSIONS:
IBM QuickFile 1.0.0.0
REMEDIATION:
The recommended solution is to apply the fix as soon as practical. Please see
below for information about the fixes available.
Fix* VRMF APAR How to acquire a fix
iFix 2 1.0.0.0 IC92323 http://www-933.ibm.com/support/fixcentral/options
Workaround(s):
None.
Mitigation(s):
None.
REFERENCES:
Complete CVSS Guide
On-line Calculator V2
CVE-2013-0440
CVE-2013-0443
CVE-2013-0169
X-Force Vulnerability Database http://xforce.iss.net/xforce/xfdb/81799
X-Force Vulnerability Database http://xforce.iss.net/xforce/xfdb/81801
X-Force Vulnerability Database http://xforce.iss.net/xforce/xfdb/81902
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUba8Ou4yVqjM2NGpAQJCfRAAi3iZOZIGqA1nvB/0pk05AhthKgTcYGWv
gcFVxP+dSRvpv0+nETQwQ74N1SsDYz1n2aBFK3e09wMp658eoGK7Be0rfUbQbQ6i
wyPjVdnfJABmPouzpiEB7dO1S0At2GrOcDPZ7dt//5Dhhc/33JGBQgVBHE6urVAS
Opl9O7fSFTuxUdMsrP8zF8NrgofEx4nleopGckTJKmyLqWHoGkNW43vF/euXdeMr
KN1cYpNv/g6FyaCz1Di2nBjDQz544Zc8yPPXjO9GVcmPW091HZc8we4F5AKK6lPn
Oik/E4zux5XayRj1IJGHddLHQaiVPocTHM8q1AjVmGj0zQoAPUTntgo0ntUKnUG6
s11lDZHDgKryNSmqoQCr6CGx5SKLaXmvDM1hy2eSugVt16kHOeKx50dAvjZ/bNwA
VERqg9doA1g5CEGm5P5C5IvRY3q0+2Sob+KewPn+Ac5l5GrgVujfJpRuwrBXBbJc
ZKH9iXEvTSpm8wLJK8t0JpyQu9rn0Xa0PE1hGCMQifZ5kMiTr0mmPWjPVAKsq/n1
zfJp60LY14ULs9hbz63TwOiFZ7s5A2JvRpA3CKHPkxDhmtj3DAY5g1Nw3TCUJga8
ZYCopiZqyRWFjsa1k6a/LYIrb3WszoD/pe48K0uXqfQmoZ5N9w9/clPqerTfOgak
MGAN7L7yWyI=
=IEZa
-----END PGP SIGNATURE-----