-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2745
        Security Bulletin: Multiple Security Vulnerabilities fixed
               in IBM WebSphere Application Server 7.0.0.39
                              3 November 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM WebSphere Application Server
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   IBM i
                   Linux variants
                   Solaris
                   Windows
                   z/OS
Impact/Access:     Increased Privileges           -- Remote/Unauthenticated      
                   Provide Misleading Information -- Remote with User Interaction
                   Unauthorised Access            -- Remote/Unauthenticated      
                   Access Confidential Data       -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-4938 CVE-2015-1932 CVE-2015-1927
                   CVE-2015-1885 CVE-2015-0250 

Reference:         ESB-2015.2674
                   ESB-2015.2446
                   ESB-2015.2408
                   ESB-2015.2392
                   ESB-2015.2391
                   ESB-2015.2390
                   ESB-2015.2328

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21969618

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere 
Application Server 7.0.0.39

Document information

More support for:

WebSphere Application Server

General

Software version:

6.1, 7.0, 8.0, 8.5, 8.5.5

Operating system(s):

AIX, HP-UX, IBM i, Linux, Solaris, Windows, z/OS

Software edition:

Base, Developer, Enterprise, Express, Liberty

Reference #:

1969618

Modified date:

2015-11-02

Security Bulletin

Summary

Cross reference list for security vulnerabilites fixed in IBM WebSphere 
Application Server, IBM WebSphere Application Server Hypervisor, WebSphere 
Application Server Liberty Profile and IBM HTTP Server.

Vulnerability Details

CVE ID: CVE-2015-1885

DESCRIPTION: WebSphere Application Server Full Profile and Liberty Profile 
could allow a remote attacker to gain elevated privileges on the system when 
OAuth grant type of password is used.

CVSS:

CVSS Base Score: 9.3

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101255 for the 
current score

CVSS Environmental Score*: Undefined

CVSS String: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are
affected:

   Version 8.5 Full Profile and Liberty Profile

   Version 8.0

   Version 7.0

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF 
for each named product as soon as practical.

Fix:

Apply an Interim Fix, Fix Pack or PTF containing this APAR PI36211 for Full 
Profile and PI33202 for Liberty Profile, as noted below:

For IBM WebSphere Application Server and IBM WebSphere Application Server 
Hypervisor Edition

For V8.5.0.0 through 8.5.5.5 Full Profile:

  Upgrade to minimal fix pack levels required by interim fix and then apply 
  Interim Fix PI36211

- -- OR

  Apply Fix Pack 6 (8.5.5.6), or later.

  After the fix pack is installed, the fix will not be active until the 
  installed OAuth ear, WebSphereOauth20SP.ear, is updated from the 
  (WAS_HOME)/installableApps directory.

For V8.5.0.0 through 8.5.5.4 Liberty Profile:

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI33202

- -- OR

  Apply Fix Pack 5 (8.5.5.5), or later.

  For V8.0.0.0 through 8.0.0.10:

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI36211

- -- OR

  Apply Fix Pack 11 (8.0.0.11), or later.

  After the fix pack is installed, the fix will not be active until the 
  installed OAuth ear, WebSphereOauth20SP.ear, is updated from the 
  (WAS_HOME)/installableApps directory.

For V7.0.0.0 through 7.0.0.37:

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI36211

- -- OR

  Apply Fix Pack 39 (7.0.0.39), or later.

  After the fix pack is installed, the fix will not be active until the 
  installed OAuth ear, WebSphereOauth20SP.ear, is updated from the 
  (WAS_HOME)/installableApps directory.

Workaround(s): None known

Mitigation(s): None known

CVEID: CVE-2015-0250

DESCRIPTION: Apache Batik could allow a remote attacker to obtain sensitive 
information. By persuading a victim to open a specially-crafted SVG file, an 
attacker could exploit this vulnerability to reveal files and obtain sensitive
information.

CVSS Base Score: 4.3

CVSS Temporal Score: See 
https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101614 for the current
score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are
affected:

  Version 8.5 Full Profile

  Version 8

  Version 7

  Version 6.1

Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix 
Pack or PTF for each named product as soon as practical.

Fix:

Apply an Interim Fix , Fix Pack or PTF containing this APAR PI39768 or 
PI49437, as noted below:

For IBM WebSphere Application Server Full profile and IBM WebSphere 
Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5:

  Apply Fix Pack 6 (8.5.5.6), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI39768

For V8.0.0.0 through 8.0.0.10:

  Apply Fix Pack 11 (8.0.0.11), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI39768

For V7.0.0.0 through 7.0.0.37:

  Apply Fix Pack 39 (7.0.0.39), or later.

- -- OR

  Apply Interim Fix PI49437

For V6.1.0.0 through 6.1.0.47:

Apply Fix Pack 47 (6.1.0.47), and then apply Interim Fix PI49437

Workaround(s): None known

Mitigation(s): None known

CVEID: CVE-2015-1927

DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to
gain elevated privileges on the system, caused by an application not having 
the correct serveServletsbyClassname setting. By a developer not setting the 
correct property, an attacker could exploit this vulnerability to gain 
unauthorized access.

CVSS Base Score: 6.8

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102872 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are
affected:

  Version 8.5 Full Profile and Liberty Profile

  Version 8

  Version 7

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF 
for each named product as soon as practical.

Fix:

Apply an Interim Fix , Fix Pack or PTF containing this APAR PI31622, as noted
below:

Please Note:This APAR has changed the default value of the WebContainer custom
property com.ibm.ws.webcontainer.disallowServeServletsByClassname from false 
to true so that no security threat could occur. Prior to this change, it was 
up to the developer to remember to change the custom property to true before 
deploying into production.

Property Name: com.ibm.ws.webcontainer.disallowServeServletsByClassname

Description: If set to true, disallows the use of 
serveServletsByClassnameEnabled at the application server level, overriding 
any setting of serveServletsByClassnameEnabled at the application level. This
property affects all applications.

Values: true(default)/false

If you need to change the value please refer to the the following technote for
instructions on enabling WebContainer custom properties:

Full Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21284395

Liberty Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21597753

For IBM WebSphere Application Server Full profile, IBM WebSphere Application 
Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5:

  Apply Fix Pack 6 (8.5.5.6), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI31622

For V8.0.0.0 through 8.0.0.10:

  Apply Fix Pack 11 (8.0.0.11), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI31622

For V7.0.0.0 through 7.0.0.37:

  Apply Fix Pack 39 (7.0.0.39), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI31622

For V6.1.0.0 through 6.1.0.47:

  Upgrade to Fix Pack 47 (6.1.0.47) and apply Interim Fix PI31622

Workaround(s): Set the custom property 
com.ibm.ws.webcontainer.disallowServeServletsByClassName to true

Mitigation(s): None known

CVEID: CVE-2015-1932

DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Virtual 
Enterprise could allow a remote attacker to obtain information that identifies
the proxy server software being used.

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102970 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are
affected:

  Version 8.5 Full Profile

  Version 8

  Version 7

  Version 7 IBM WebSphere Virtual Enterprise on WebSphere Application Server 
  Version 7 and Version 8

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF 
for each named product as soon as practical.

Fix:

Apply an Interim Fix , Fix Pack or PTF containing this APAR PI38403, as noted
below:

Note:

By default, the ODR and proxy server will ignore the http.compliance.via 
custom property and not set the HTTP Via header. A new custom property is 
being introduced that if set to false will allow the http.compliance.via 
setting to be honored. The custom property, http.ignore.compliance.via can be
set on an ODR or Proxy server.

In the Administrative console, expand Servers>Server Types > On Demand Routers
> server_name to open the configuration tab for the server.

Expand On Demand Router settings, click On Demand Router Properties

Under Additional properties, click Custom properties > new.

For IBM WebSphere Application Server Full profile, IBM WebSphere Application 
Server Hypervisor Edition and IBM WebSphere Virtual Enterprise

For V8.5.0.0 through 8.5.5.6:

  Apply Fix Pack 7 (8.5.5.7) or later.

- -- OR

  Apply the mitigation below

For V8.0.0.0 through 8.0.0.10:

  Apply Fix Pack 11 (8.0.0.11), or later.

- -- OR

  Apply the mitigation below

For V7.0.0.0 through 7.0.0.37:

  Apply Fix Pack 39 (7.0.0.39), or later.

- -- OR

  Apply the mitigation below

For IBM WebSphere Virtual Enterprise using WebSphere Application Server V7.0 
and V8.0:

  Apply WebSphere Virtual Enterprise Fix Pack 7 (7.0.0.7) or later (targeted to
  be available 1Q 2016).

- -- OR

  Apply the mitigation below

Workaround(s): None known

Mitigation(s): Remove the custom property http.compliance.via or set it to 
false.

To remove the custom property http.compliance.via:

In the Administrative console, expand Servers>Server Types > On Demand Routers
> server_name to open the configuration tab for the server.

Expand On Demand Router Properties, click On Demand Router Settings

Under Additional properties, click Custom properties, select the check box 
next to http.compliance.via property and press the Delete button.

Alternatively, to set the property to false, click on http.compliance.via and
change the value of the property to false and press the OK button.

CVEID: CVE-2015-4938

DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to
spoof a servlet. An attacker could exploit this vulnerability to persuade the
user into entering sensitive information.

CVSS Base Score: 3.5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/104415 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are
affected:

  Version 8.5 Full Profile and Liberty Profile

  Version 8

  Version 7

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF 
for each named product as soon as practical.

Fix:

Apply an Interim Fix , Fix Pack or PTF containing this APAR PI37396, as noted
below:

For IBM WebSphere Application Server Full profile, IBM WebSphere Application 
Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.6:

  Apply Fix Pack 7 (8.5.5.7), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI37396

For V8.0.0.0 through 8.0.0.10:

  Apply Fix Pack 11 (8.0.0.11), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI37396

For V7.0.0.0 through 7.0.0.37:

  Apply Fix Pack 39 (7.0.0.39), or later.

- -- OR

  Upgrade to minimal fix pack levels as required by interim fix and then apply 
  Interim Fix PI37396

Workaround(s): None known

Mitigation(s): None known

Other APARs shipped with 7.0.0.39 are included in the security bulletins 
below:

PI39833 Security bulletin: IBM HTTP Server Windows Denial of Service

PI36563 Security Bulletin: RSA Export Keys for WebSphere Application Server

PI36563/PI35289 Security Bulletin: RC4 Stream Cipher for WebSphere Application
Server

PI38302 Security Bulletin: Management Port for WebSphere Application Server

PI36417 Security Bulletin: RSA Export Keys for IBM HTTP Server

PI34229 Security Bulletin: RC4 Stream Cipher for IBM HTTP Server

PI42928 Security Bulletin: HTTP Request Smuggling for IBM HTTP Server

PI44793 Security Bulletin: Stack Buffer overflow for IBM HTTP Server

PI45266 Security Bulletin: HTTP Response splitting attack in WebSphere 
Application Server

PI45596 Security Bulletin: Denial of Service for IBM HTTP Server

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support 
alerts like this.

Important note

IBM strongly suggests that all System z customers be subscribed to the System
z Security Portal to receive the latest critical System z security and 
integrity service. If you are not subscribed, see the instructions on the 
System z Security web site. Security and integrity APARs and associated fixes
will be posted to this portal. IBM suggests reviewing the CVSS scores and 
applying all security or integrity fixes as soon as possible to minimize any 
potential risk.

References

Complete CVSS v2 Guide

On-line Calculator v2

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Change History

02 November 2015: original document published

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the 
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the 
Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVjgSAn6ZAP0PgtI9AQKdJQ/8CM7/AD0yGLKqC7rBv32tcOWbL2mQwfFB
GXgLmHhV8TYV8BJBEEpeH8363RonGyknjelLlkFcXT5h2NuKHEtEVsywySDSSscD
GnrAO+otT/DknVGo/aL5x2ubC56el6xWAzEUK/BS0YmRjN4G5wsP3PM9yllhJXe9
H8rIBjj//iiwssYmkpHStqcq30SpoV9Xvbh8vJ6F/QDI8ehdZ446X9ReL0B6GBu/
9yHKjK2ZSa3pHenMGVAYGXuMxawNoPcmE9WAbMypAfmSUhfnCRTGJqxgDBMn1zIE
zlQ3U/WPoyU3FWQNHNQ+aQX1dInFCa/icvFR/OQymXGqOE0bH+BSSYeQJO+vORzA
fvkqHXpfdOXR1B2O71U/RtxN/Tdtsp8sxiIt6Gd9EVW9yapWBKdB+dFFZHfc8Ey2
h6G9JZj97NWvGg3siNDYDFgIn6SnaTz1WlRmXL1mo/42a6tXH6gEPEWwp0j1ooO2
Z339U27g/fxTKowLAG9WWgREfl+aY3pw4wgefmBFpSMjLy10yj0ubbp0WzzJUNs8
a0omdv9Y43Ewx5nXm3l2xOQdp1K2U3qWRAiKP/R7nDKWbd6JlPMXz+TC1bzJNRtf
GAEmtdxKliaRI8g7WJRgZhs9oY322MVtxqrVNFXz5bkvZL2yREb10NNYOOwLMA3b
OJD7LOIP3tQ=
=4Ikq
-----END PGP SIGNATURE-----