-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2381
          Security Bulletin: Multiple vulnerabilities in IBM Java
          Runtime affect Sterling External Authentication Server
                             10 September 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Sterling External Authentication Server
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Access Confidential Data -- Remote/Unauthenticated
                   Denial of Service        -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-4749 CVE-2015-2625 CVE-2015-2613
                   CVE-2015-2601 CVE-2015-1931 

Reference:         ASB-2015.0070
                   ESB-2015.2330
                   ESB-2015.2209
                   ESB-2015.1917
                   ESB-2015.1890
                   ESB-2015.1873

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21965912

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect
Sterling External Authentication Server

Document information
More support for:

Sterling Secure Proxy
External Authentication Server

Software version:
3.3.1, 3.4, 3.4.1, 3.4.2

Operating system(s):
AIX, HP-UX, Linux, Solaris, Windows

Reference #:
1965912

Modified date:
2015-09-09

Security Bulletin

Summary

There are multiple vulnerabilities in IBM Runtime Environment Java
Technology Edition, Version 1.7.0 that is used by Sterling External
Authentication Server. These issues were disclosed as part of the IBM Java
SDK updates in July 2015.
Vulnerability Details

CVEID: CVE-2015-2613
DESCRIPTION: An unspecified vulnerability and Java SE Embedded related to the
JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/104734 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-2601
DESCRIPTION: An unspecified vulnerability related to the JCE component
could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/104733 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-4749
DESCRIPTION: An unspecified vulnerability related to the JNDI component
could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/104740 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-2625
DESCRIPTION: An unspecified vulnerability related to the JSSE component
could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 2.6
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/104743 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-1931
DESCRIPTION: IBM Java Security Components store plain text data in memory
dumps, which could allow a local attacker to obtain information to aid in
further attacks against the system.
CVSS Base Score: 2.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102967 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Sterling External Authentication Server 2.4.2 through 2.4.2.0 iFix 1
IBM Sterling External Authentication Server 2.4.1 through 2.4.1.8 iFix 5
IBM Sterling External Authentication Server 2.4.0 through 2.4.0.4 iFix 6
IBM Sterling External Authentication Server 2.3.01 through 2.3.1.11 iFix 6

Remediation/Fixes

Product			VRMF	iFix	Remediation/First Fix
IBM Sterling External 	2.4.2.0	iFix 2	Fix Central
Authentication Server
	
IBM Sterling External 	2.4.1.8	iFix 6	Contact Support and request the fix 
Authentication Server			package be published for you on the 
					ECuRep server

IBM Sterling External	2.4.0.4	iFix 7	Contact Support and request the fix 
Authentication Server			package be published for you on the 
					ECuRep server
IBM Sterling External 	2.3.1.23iFix 7	Contact Support and request the fix 
Authentication Server			package be published for you on the 
					ECuRep server

Contact Support and request the fix package be published for you
on the ECuRep server.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

Important note

IBM strongly suggests that all System z customers be subscribed to the
System z Security Portal to receive the latest critical System z security
and integrity service. If you are not subscribed, see the instructions
on the System z Security web site. Security and integrity APARs and
associated fixes will be posted to this portal. IBM suggests reviewing
the CVSS scores and applying all security or integrity fixes as soon as
possible to minimize any potential risk.

References
Complete CVSS v2 Guide
On-line Calculator v2
IBM Java SDK July 2015 Security Bulletin

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

09 September 2015; Original Version Published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.


Cross reference information

Segment		Product			Component	Platform	Version	Edition
Commerce	IBM Control Center

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVfDjAn6ZAP0PgtI9AQKqfg//f16G9aj+xqlUsxu/i70f0t63ogLApZ9b
8YDbIMN34axXoHfgPbtNfuiOYwMTrAW8deRv+AmK0mhcDLs2YR1HKBAchqzVy6q3
iL20NSopSE6e2g05t5efzkOiGM4pxP6r6rhm9zj6GxkYp7oDnyzkWbpkdjh54Ser
0D28uX1INiwBrJyXDBYPjLsUEc5TxXdha0oFAKWeCCAnMNARm0WSeHjHIq036rlC
WDs9vMsZCRUQfUNbG1ku5cIgFa7/hg5U79BEZ0JVuIEc8T9mDkrBRTPoNFXxFRnM
asjq5tFrXG7rq7UWlHLAYu01dlwt3aZ+VCb0t+41e1GcRTaCsAyMsvPXZVMhv3fD
UXl2VIEf1cPxiRPGlw6kMzJpvrNefywb/V3tKGhWY+r4slyE2M1SVnREZgWUbvZH
gdFrRtSeNjY6QkuqdfSosHJuQx+bhfb41X/ZI/x7sWY7DiQfK9EcJim2r3HPub62
qrbeeU5ilCPEJs6uxaC046Twa72MMsNO+g4rrHcBJf8vvOTgvinEzAPY/sO4Jx+1
vxbX0Wy13IKJZdc6XEGJ3PT7XjWfcQ4QVbikbqvdOi9g9bzA5ZbI5VR2WC5Sapjc
1A6oDTumEosSPRLyf/AhKPBcPJEaQjgUrhdxTIafIdWLAw2SOkn4v0i9MUE4cbJY
NBawSyEVUHs=
=5Q3N
-----END PGP SIGNATURE-----