Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1119
Security Bulletin: WebSphere Transformation Extender affected by multiple
security vulnerabilities in the IBM Runtime Environment, Java Technology
Edition ( CVE-2014-0416, CVE-2014-0453, CVE-2014-0460 )
9 July 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM WebSphere Transformation Extender
Publisher: IBM
Operating System: AIX
HP-UX
Linux variants
Solaris
Windows
Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-0460 CVE-2014-0453 CVE-2014-0416
Reference: ASB-2014.0063
ASB-2014.0053
ASB-2014.0005
ESB-2014.1118
ESB-2014.1100
ESB-2014.1090
ESB-2014.0102
ESB-2014.0065
ESB-2014.0058
Original Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg21677294
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: WebSphere Transformation Extender affected by multiple
security vulnerabilities in the IBM Runtime Environment, Java Technology
Edition ( CVE-2014-0416, CVE-2014-0453, CVE-2014-0460 )
Document information
More support for:
WebSphere Transformation Extender
Software version:
8.2, 8.3, 8.4, 8.4.1
Operating system(s):
AIX, HP Itanium, HP-UX, Linux, Linux zSeries, Solaris, Windows
Reference #:
1677294
Modified date:
2014-06-30
Security Bulletin
Summary
WebSphere Transformation Extender is shipped with IBM Runtime Environment,
Java Technology Edition (the IBM RE), that is based on an Oracle Java
Runtime Environment (JRE). Oracle has released the January and April 2014
critical patch updates (CPU) that contain security vulnerability fixes
for the JRE. The IBM RE has been updated to incorporate these fixes and
security fixes that are specific to the IBM RE. WebSphere Transformation
Extender is affected by some of the vulnerabilities in the CPU, and the
IBM RE shipped with WebSphere Transformation Extender has been updated to
remediate the vulnerabilities.
Vulnerability Details
CVE ID: CVE-2014-0416
Description: An unspecified vulnerability in Oracle Java SE related to the
JAAS component has no confidentiality impact, partial integrity impact,
and no availability impact.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90349 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVE ID: CVE-2014-0453
Description: An unspecified vulnerability in Oracle Java SE related to the
Security component has partial confidentiality impact, partial integrity
impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92490 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVE ID: CVE-2014-0460
Description: An unspecified vulnerability in Oracle Java SE related to
the JNDI component has partial confidentiality impact, partial integrity
impact, and no availability impact.
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92482 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected Products and Versions
* WebSphere Transformation Extender Design Studio 8.2 , 8.3 , 8.4 , 8.4.1
* WebSphere Transformation Extender with Command Server 8.2 , 8.3 , 8.4
, 8.4.1
* WebSphere Transformation Extender for Integration Servers 8.2 , 8.3 ,
8.4 , 8.4.1
* WebSphere Transformation Extender for Application Programming 8.2 ,
8.3 , 8.4 , 8.4.1
* WebSphere Transformation Extender with Launcher 8.2 , 8.3 , 8.4 , 8.4.1
* WebSphere Transformation Extender with Launcher Hypervisor Edition 8.4
, 8.4.1
* WebSphere Transformation Extender with Launcher Hypervisor Edition for
AIX 8.4.1
Remediation/Fixes
Version Remediation
8.4.1 Download and install 8.4.1.2 from
http://www.ibm.com/software/howtobuy/passportadvantage
8.2 , 8.3 , 8.4.0 Download and install the interim fix from
http://www.ibm.com/support/fixcentral
Workarounds and Mitigations
None.
Important note
IBM strongly suggests that all System z customers be subscribed to the
System z Security Portal to receive the latest critical System z security
and integrity service. If you are not subscribed, see the instructions
on the System z Security web site. Security and integrity APARs and
associated fixes will be posted to this portal. IBM suggests reviewing
the CVSS scores and applying all security or integrity fixes as soon as
possible to minimize any potential risk.
References
Complete CVSS Guide
On-line Calculator V2
Security Bulletin: Multiple vulnerabilities in current releases of IBM SDK,
Java Technology Edition related to Oracle January 2014 Critical Patch Update
Security Bulletin: Multiple vulnerabilities in current releases of the
IBM SDK, Java Technology Edition related to Oracle April 2014 Critical
Patch Update
Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Change History
26 June 2014: Initial publication.
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
Product Alias/Synonym
WTX
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU7zbxxLndAQH1ShLAQJHCw//WFBkcIhv4pygHfyY7tkhiy8CvgAPBJKl
F6WIBt8TnuvcQywfXUNHK60g/31UOQH+SoYAytwa5EcTwfHg2kv4T1Ke1mFuDu5x
WBJ25EnZyQQngmzS1qYYiRKM8HuIekBOzRVxn6CgucNHzmNdewqA1cipEXKiiLkn
Zyb64dF1+a5gxmBjtvlGhshPuJzxTbR99rOqozR597aLJFzH3TtWWIkAnHfXlX25
OhzKbyuwsbKxBxSKJenLUUaRWhsZ0ygXIvIIa3kB1U6Mrq/wxpSAi2DbFqOIBw1S
78R8avlP0Uo/rIj/V5isO5KOChHyJsByZRhVZ5IJFTG5yeD1P4NCTD6dT3K4MIlQ
NYzg7EwCgXcnkNsq51vIdAT59fmyFg1dlWuPpYtdvmnoMr4gvVOX5Ncs7y88ct9j
dRvfltS0FQPdbofkMANx/o6QDJqO6VUWCde80y2F/YnFzGS6t/I/CT+lmhOQX2QI
lQ+31swrYMXQTPq2XblKCKBZBzYXVUY28iXui1eOZWJgH2V+Z51gdi/dOBtQkz0u
Ks1O3WsElgJgFKpB065ZxAcqVvRvBOLbOZTf9HtNCAUKRzBBQJ2bP6pqw07ZmMjw
lHRsiehznQO0b8ho0n+YELpaCjFOqWMYkS3xeJ8IIOpWfYMNgeRQvxI22EMj94FN
CGIlOTb0cZY=
=5H5W
-----END PGP SIGNATURE-----