Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0932
Security Bulletin: Potential security vulnerabilities in WebSphere Partner
Gateway Advanced/Enterprise for the Oracle CPU February 2013.
8 July 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM WebSphere Partner Gateway Advanced Edition
Publisher: IBM
Operating System: AIX
Linux variants
Solaris
Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Delete Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-0443 CVE-2013-0440 CVE-2013-0169
Reference: ASB-2013.0069
ASB-2013.0025
ASB-2013.0013
ESB-2013.0924
ESB-2013.0916
ESB-2013.0870
ESB-2013.0847
ESB-2013.0846
Original Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg21641009
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: Potential security vulnerabilities in WebSphere Partner
Gateway Advanced/Enterprise for the Oracle CPU February 2013.
Flash (Alert)
Document information
WebSphere Partner Gateway Advanced Edition
Software version:
6.2.0.1, 6.2.0.2, 6.2.0.3, 6.2.0.4, 6.2.0.5, 6.2.1, 6.2.1.0, 6.2.1.1, 6.2.1.2
Operating system(s):
AIX, Linux, Linux iSeries, Linux pSeries, Solaris, Windows
Reference #:
1641009
Modified date:
2013-06-25
Abstract
The IBM WebSphere Partner Gateway is shipped with an IBM Java SDK that is based
on the Oracle SDK. The February 2013 Oracle Critical Patch Updates (CPU)
contained various security vulnerability fixes for the Oracle JDKs. The IBM
Java SDK that WebSphere Partner Gateway ship is similarly affected
Content
VULNERABILITY DETAILS
CVE-2013-0440 - Unspecified vulnerability in Java Runtime Environment allows
remote attackers to affect availability via vectors related to JSSE.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81799
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE-2013-0443 - Unspecified vulnerability in Java Runtime Environment allows
remote attackers to affect confidentiality and integrity via vectors related
to JSSE.
CVSS Base Score: 4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81801
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVE-2013-0169 - The TLS protocol does not properly consider timing side-channel
attacks, which allows remote attackers to conduct distinguishing attacks and
plain-text recovery attacks via statistical analysis of timing data for
crafted packets, aka the "Lucky Thirteen" issue.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81902
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
DESCRIPTION:
This Security Bulletin addresses the security vulnerabilities that have
shipped with the IBM SDK and is part of the Oracle February 2013 critical
patch updates (CPU). For details on these updates please refer to the
Reference section of this bulletin.
Versions Affected.
WebSphere Partner Gateway Advanced/Enterprise Edition Versions 6.2 through
6.2.1.2
REMEDIATION:
Upgrade your JAVA SDK to an interim fix level as determined below.
Fix* VRMF APAR How to acquire fix
WAS 7.0 IFIX 7.0.0.0 through 7.0.0.27 PM80757 PM80757
WAS 6.1 IFIX 6.1.0.0 through 6.1.0.45 PM80756 PM80756
WPG IFIX 6.2.1.2 JR46069 JR46069
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUdoo+hLndAQH1ShLAQLkXQ/+O9YAW+gdkGOuE1yxlqPXdwRwpBGiqNFt
lm3M16sFqOgbU7J3PPF0CSoN75qRFGAK0zyrAtkq9efSKlkykkevGq24pNzxqVoz
gji7AWxNZReVCTZTSRpIAKeyNR9+EiwBz65IFGT3s5Peatd6cfY7s0WYAbkElPS8
LKVBBbyp6b1jd3FB9BNFHI0cSfQG7AQRNvTGlf34hqi/9qAKK6Bv2l4Cfe5BFdif
qwrIJRHIXRyaZCmbxc4padHyHeki6sTav/05O98nxzFkCsYoEYqTiSyRYmYGgiv9
Z4LtfCvm5vHZfQ8HCC6DN8vay8w8b3yao+kscIYYSuhypJlWheAW9Yfk4pQMrgt+
OCr3UABr5aJHkehSEtIZMQLvEnpqlOLGY2TbdEqMVebPB98zdzFZNlOOwRhJ80tp
Itk8/x4xyqqvl3eezsV0hchAGwboRU5UHVumX+t3TOk2GOmUGjyO4Uw05r0LPWtA
2lPNPZM1ae/9xXWMGPSV1lydwOxKMO5bTA5nhm5kKr8zd0ni7MOxi74sjCYgxNsA
ZOlD8MEwGr5Z/ddtpLddUDDSXAJ5vnSFnEnZPSO3DRfJLvyfU2JKfLsGj41HGWLG
wToUk/xUnoKG0+Rm19TVv/tKeQx0oVROWFsEFbDWjsFCjNXLFwBIuIQbkCnGIIyU
3QNXTs9ICds=
=uRqD
-----END PGP SIGNATURE-----