Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.1154 Multiple vulnerabilities have been identified in IBM Algo Audit and Compliance 11 July 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: IBM Algo Audit and Compliance Publisher: IBM Operating System: Windows Impact/Access: Denial of Service -- Remote/Unauthenticated Cross-site Scripting -- Remote with User Interaction Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2014-0119 CVE-2014-0099 CVE-2014-0096 CVE-2014-0075 CVE-2014-0033 CVE-2013-4590 CVE-2013-4322 CVE-2013-4286 Reference: ASB-2014.0074 ESB-2014.1145 ESB-2014.1136 ESB-2014.1134 ESB-2014.0563 ESB-2014.0468 ESB-2014.0441 ESB-2014.0440 ESB-2014.0420 Original Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21677222 http://www-01.ibm.com/support/docview.wss?uid=swg21675006 - --------------------------BEGIN INCLUDED TEXT-------------------- Security Bulletin: Multiple Apache Tomcat vulnerabilities in IBM Algo Audit and Compliance (CVE-2014-0075, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119) Security Bulletin Document information More support for: Algo Audit and Compliance Software version: 2.1 Operating system(s): Windows Software edition: All Editions Reference #: 1677222 Modified date: 2014-06-30 Summary IBM Algo Audit and Compliance uses Apache Tomcat and is affected by multiple vulnerabilities identified in it, which could permit an attacker to cause a denial of service and to obtain sensitive information Vulnerability Details CVE ID: CVE-2014-0075 Description: A denial of service vulnerability has been identified in Apache Tomcat that could allow a remote attacker to cause a denial of service attack, caused by an error in the handling of a malformed chunk size. The attack requires network access, no authentication and a low degree of specialized knowledge and technique. An attack may partially impact availability of the system but not the confidentiality of information or the integrity of data. CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93365 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2014-0096 Description: An information disclosure vulnerability has been identified in Apache Tomcat that could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data by the default server. By sending specially crafted XML data, an attacker could exploit this vulnerability to obtain sensitive information. The attack requires network access, no authentication and a medium degree of specialized knowledge and technique. An attack may partially impact the confidentiality of information but not the integrity of data or the availability of the system. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93367 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2014-0099 Description: An information disclosure vulnerability has been identified in Apache Tomcat that could allow a remote attacker to obtain sensitive information, caused by the failure to check for overflows when parsing content length headers. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information. The attack requires network access, no authentication and a low degree of specialized knowledge and technique. An attack may partially impact the confidentiality of information but not the integrity of data or the availability of the system. CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93369 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2014-0119 Description: An information disclosure vulnerability has been identified in Apache Tomcat that could allow a remote attacker to obtain sensitive information, caused by the replacement of the XML parsers used to process XSLTs for the default servlet. By using a specially crafted application, an attacker could exploit this vulnerability to obtain sensitive information. The attack requires network access, no authentication and a low degree of specialized knowledge and technique. An attack may partially impact the confidentiality of information but not the integrity of data or the availability of the system. CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93368 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) Affected Products and Versions IBM Algo Audit and Compliance versions 2.1 - 2.1.0.2 Remediation/Fixes Download and install IBM Algo Audit and Compliance version 2.1.0.2 interim fix 1 from Fix Central, details available at http://www-01.ibm.com/support/docview.wss?uid=swg24037884 Workarounds and Mitigations None known References Complete CVSS Guide On-line Calculator V2 CVE-2014-0075 http://xforce.iss.net/xforce/xfdb/93365 CVE-2014-0096 http://xforce.iss.net/xforce/xfdb/93367 CVE-2014-0099 http://xforce.iss.net/xforce/xfdb/93369 CVE-2014-0119 http://xforce.iss.net/xforce/xfdb/93368 Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgement None Change History 30 June 2013: Original version published *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - ------------------------------------------------------------------------------- Security Bulletin: Multiple Apache Tomcat vulnerabilities in IBM Algo Audit and Compliance (CVE-2013-4286, CVE-2013-4322, CVE-2013-4590, CVE-2014-0033) Security Bulletin Document information More support for: Algo Audit and Compliance Software version: 2.1 Operating system(s): Windows Software edition: All Editions Reference #: 1675006 Modified date: 2014-06-30 Summary IBM Algo Audit and Compliance uses Apache Tomcat and is affected by multiple vulnerabilities identified in it, which could permit an attacker to compromise the web cache, bypass web application firewall protection and conduct XSS attacks, to cause a denial of service, to obtain sensitive information and to hijack a user's session Vulnerability Details CVE ID: CVE-2013-4286 Description: An HTTP request smuggling vulnerability has been identified in Apache Tomcat that could allow a remote attacker to compromise the web cache, bypass web application firewall protection, and conduct XSS attacks. This vulnerability is caused by an error in the handling of a malicious request. The attack requires network access, no authentication and a medium degree of specialized knowledge and technique. An attack may partially impact the integrity of data but not the confidentiality of information or the availability of the system. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/91426 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVE-2013-4322 Description: A denial of service vulnerability has been identified in Apache Tomcat that could allow a remote attacker to cause a denial of service attack, caused by an error in the handling of a malicious request. The attack requires network access, no authentication and a low degree of specialized knowledge and technique. An attack may partially impact availability of the system but not the confidentiality of information or the integrity of data. CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/91625 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2013-4590 Description: An information disclosure vulnerability has been identified in Apache Tomcat that could allow a remote attacker to obtain sensitive information, caused by an error when running untrusted web applications. By sending a specially-crafted request, an attacker could exploit this vulnerability to read arbitrary files and obtain sensitive information. The attack requires network access, no authentication and a medium degree of specialized knowledge and technique. An attack may partially impact the confidentiality of information but not the integrity of data or the availability of the system. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/91424 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2014-0033 Description: A vulnerability has been identified in Apache Tomcat that could allow a remote attacker to hijack a valid user's session, caused by an error even when disableURLRewriting is enabled. An attacker could exploit this vulnerability to hijack another user's account and possibly launch further attacks on the system. The attack requires network access, no authentication and a medium degree of specialized knowledge and technique. An attack may partially impact the integrity of data but not the confidentiality of information or the availability of the system. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/91423 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) Affected Products and Versions IBM Algo Audit and Compliance versions 2.1 - 2.1.0.2 Remediation/Fixes Download and install IBM Algo Audit and Compliance version 2.1.0.2 interim fix 1 from Fix Central, details available at http://www-01.ibm.com/support/docview.wss?uid=swg24037884 Workarounds and Mitigations None known References Complete CVSS Guide On-line Calculator V2 CVE-2013-4286 http://xforce.iss.net/xforce/xfdb/91426 CVE-2013-4322 http://xforce.iss.net/xforce/xfdb/91625 CVE-2013-4590 http://xforce.iss.net/xforce/xfdb/91424 CVE-2014-0033 http://xforce.iss.net/xforce/xfdb/91423 Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgement None Change History 30 June 2013: Original version published *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBU79UshLndAQH1ShLAQI0HhAAq9tFPT1OY3Xe6VsdIf7wi+l1GJ8zoYKO R937CngSjOmzSqZaSPoFcscKMYBHxS7ir4iVjRRxPDOJbC17lj06R9f5a2yxIDbR EhAe/3jDEy9I1aQIHiRgpZ4InHUFWngA5ZH1SrXrwneJ9Vg4XeqTLZXB+1y52fG9 j63j3dy7IGCuu7ogOmkYL+lWfsnw5as1xV7n/d95/mmr7tIOONK3ED2bNOkkmSuJ VSp4O5dzKIgkzi5DWmRjKMQ+vYMJxoltNrfsH9XvwycjIxzWJBbilafYvI0ripXh qF7EhbsgUsylW3rn3TjgwDgJDfKKkAXuvq2zP69nSp6eozG5ACJX13ceDp3xPOrO vFDxFfyabyD6/jfy9KomPxLXAt/v+afEBoLJkjYGuD5QoqKT2mpJonZ/NWoWNhft TAdrL3dyIKYr/WOmasx6ggDmBbXvm78MQUM6VLTmvsIeRPaKQor+vKGSkWsIpaHG A3P00NDf/W4C3NMFb3QiSImdv08i7L1sHvnqpHJDPpp1EukcPZGElsEieBTy/LdS ATKJmk1zYr/mrhqO8nv7iqv9V7vWth1+Urvp87uD1kNtzmpEzpz3lyEuMwkV6R+S gp7Huj4vM342fmJSNf0Y5Cqd5fLikj8K4y8Ksk6Ov6kqubzAmvYOP3JCteI+I7z8 4MtrNKja4YI= =jg4x -----END PGP SIGNATURE-----