-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.1869
          Security Bulletin: Multiple vulnerabilities affect IBM
         FileNet products and Enterprise Content Management System
                               2 August 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM FileNet products
                   IBM Enterprise Content Management System Monitor
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                   Access Privileged Data          -- Remote with User Interaction
                   Denial of Service               -- Remote/Unauthenticated      
                   Provide Misleading Information  -- Remote with User Interaction
                   Access Confidential Data        -- Remote/Unauthenticated      
                   Reduced Security                -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-5878 CVE-2016-2176 CVE-2016-2109
                   CVE-2016-2107 CVE-2016-2106 CVE-2016-2105
                   CVE-2016-0797 CVE-2016-0705 CVE-2016-0703
                   CVE-2016-0494 CVE-2016-0483 CVE-2016-0448
                   CVE-2016-0402 CVE-2015-8540 CVE-2015-8472
                   CVE-2015-8126 CVE-2015-7981 CVE-2015-7575

Reference:         ASB-2016.0074
                   ASB-2016.0043
                   ESB-2016.1076
                   ESB-2016.0047
                   ESB-2016.0046
                   ESB-2015.2856

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=swg21984483
   http://www.ibm.com/support/docview.wss?uid=swg21987721

Comment: This bulletin contains two (2) IBM security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and OpenSSL
affect IBM FileNet System Monitor/IBM Enterprise Content Management System

Security Bulletin

Document information

More support for:

FileNet System Monitor

Software version:

4.5.0, 5.1, 5.2

Operating system(s):

AIX, HP-UX, Linux, Solaris, Windows

Reference #:

1984483

Modified date:

2016-08-01

Summary

OpenSSL vulnerabilities were disclosed on March 1, 2016 & May 3, 2016 by the
OpenSSL Project. OpenSSL is used by Enterprise Content Management System
Monitor has addressed the applicable CVEs.

There are multiple vulnerabilities in IBM SDK Java Technology Edition,
Version 6 and 7 that is used by IBM FileNet System Monitor/IBM Enterprise
Content Management System Monitor.These issues were disclosed as part of the
IBM Java SDK updates in January 2016

Vulnerability Details

CVEID:

CVE-2016-2107

DESCRIPTION:

OpenSSL could allow a remote attacker to obtain sensitive information, caused
by an error when the connection uses an AES CBC cipher and the server support
AES-NI. A remote user with the ability to conduct a man-in-the-middle attack
could exploit this vulnerability via the POODLE (Padding Oracle On Downgraded
Legacy Encryption) attack to decrypt traffic.

CVSS Base Score: 4.3

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/112854

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID:

CVE-2016-2105

DESCRIPTION:

OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper
bounds checking by the EVP_EncodeUpdate() function. By sending an overly long
argument, a remote attacker could overflow a buffer and execute arbitrary
code on the system or cause the application to crash.

CVSS Base Score: 5.6

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/112855

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:

CVE-2016-2106

DESCRIPTION:

OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper
bounds checking by the EVP_EncryptUpdate() function. By sending an overly
long argument, a remote attacker could overflow a buffer and execute
arbitrary code on the system or cause the application to crash.

CVSS Base Score: 5.6

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/112856

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:

CVE-2016-2109

DESCRIPTION:

OpenSSL is vulnerable to a denial of service, caused by a memory allocation
error. By reading specially crafted ASN.1 data from a BIO using functions
such as d2i_CMS_bio(), an attacker could exploit this vulnerability to
consume all available resources and exhaust memory.

CVSS Base Score: 5.3

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/112857

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:

CVE-2016-2176

DESCRIPTION:

OpenSSL could allow a remote attacker to obtain sensitive information, By
sending an overly long ASN.1 string to the X509_NAME_oneline() function, an
attacker could exploit this vulnerability to return arbitrary stack data in
the buffer.

CVSS Base Score: 5.3

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/112858

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:

CVE-2016-0703

DESCRIPTION:

OpenSSL could allow a remote attacker to bypass security restrictions, caused
by the failure to enforce that a clear-key-length value is 0 for non-export
ciphers by the SSLv2 's2_srvr.c code. When clear-key bytes displace
encrypted-key bytes, an attacker could exploit this vulnerability to conduct
a divide-and-conquer key recovery attack.

CVSS Base Score: 7.4

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/111145

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:

CVE-2016-0705

DESCRIPTION:

OpenSSL is vulnerable to a denial of service, caused by a double-free error
when parsing DSA private keys. An attacker could exploit this vulnerability
to corrupt memory and cause a denial of service.

CVSS Base Score: 3.7

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/111140

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:

CVE-2016-0797

DESCRIPTION:

OpenSSL is vulnerable to a denial of service, caused by a NULL pointer
dereference in the BN_hex2bn/BN_dec2bn() function. An attacker could exploit
this vulnerability using specially crafted data to cause a denial of service.

CVSS Base Score: 3.7

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/111142

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:

CVE-2016-0494

DESCRIPTION:

An unspecified vulnerability related to the 2D component has complete
confidentiality impact, complete integrity impact, and complete availability
impact.

CVSS Base Score: 10

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109944

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID:

CVE-2016-0483

DESCRIPTION:

An unspecified vulnerability related to the AWT component has complete
confidentiality impact, complete integrity impact, and complete availability
impact.

CVSS Base Score: 10

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109945

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID:

CVE-2015-8126

DESCRIPTION:

libpng is vulnerable to a buffer overflow, caused by improper bounds checking
by the png_set_PLTE() and png_get_PLTE() functions. By persuading a victim to
open a specially-crafted PNG file, a remote attacker could overflow a buffer
and execute arbitrary code on the system.

CVSS Base Score: 7.8

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/108010

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/UI:U/C:H/I:H/A:H)

CVEID:

CVE-2015-8472

DESCRIPTION:

libpng is vulnerable to a buffer overflow, caused by improper bounds checking
by the png_get_PLTE() and png_set_PLTE() functions. By persuading a victim to
open a specially crafted PNG image, a remote attacker could overflow a buffer
and execute arbitrary code on the system or cause the application to crash.

CVSS Base Score: 6.3

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109392

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/UI:U/C:L/I:L/A:L)

CVEID:

CVE-2016-0402

DESCRIPTION:

An unspecified vulnerability related to the Networking component has no
confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 5

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109947

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVEID:

CVE-2016-0448

DESCRIPTION:

An unspecified vulnerability related to the JMX component could allow a
remote attacker to obtain sensitive information.

CVSS Base Score: 4

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109949

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVEID:

CVE-2015-8540

DESCRIPTION:

libpng is vulnerable to a buffer overflow, caused by a read underflow in
png_check_keyword in pngwutil.c. By sending an overly long argument, a remote
attacker could overflow a buffer and execute arbitrary code on the system or
cause the application to crash.

CVSS Base Score: 9.8

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109219

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:

CVE-2015-7981

DESCRIPTION:

libpng could allow a remote attacker to obtain sensitive information, caused
by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker
could exploit this vulnerability to obtain sensitive information.

CVSS Base Score: 5.3

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/107740

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:

CVE-2015-7575

DESCRIPTION:

The TLS protocol could allow weaker than expected security caused by a
collision attack when using the MD5 hash function for signing a
ServerKeyExchange message during a TLS handshake. An attacker could exploit
this vulnerability using man-in-the-middle techniques to impersonate a TLS
server and obtain credentials.

CVSS Base Score: 7.1

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109415

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

IBM FileNet System Monitor v4.5.0

IBM Enterprise Content Management System Monitor v5.1.0

IBM Enterprise Content Management System Monitor v5.2.0

Remediation/Fixes

Product                                           VRM    Remediation
IBM FileNet System Monitor                        4.5.0  Use FSM 450-FP3-IF5 avaible at https://www-933.ibm.com/support/fixcentral/
IBM Enterprise Content Management System Monitor  5.1.0  Use ECM SM 510-FP3-IF8 avaible at https://www-933.ibm.com/support/fixcentral/
IBM Enterprise Content Management System Monitor  5.2.0  Use ECM SM 5.2.0.3 avaible at https://www-933.ibm.com/support/fixcentral/

Workarounds and Mitigations

NA

Get Notified about Future Security Bulletins

Subscribe to

My Notifications

to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

NA

Change History

July 29, 2016 Original Version Published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- ---

Security Bulletin: FileNet Workplace can be affected by the Open URL
Redirection Vulnerability (CVE-2016-5878)

Security Bulletin

Document information

More support for:

FileNet Content Manager

Application Engine

Software version:

4.0.2

Operating system(s):

AIX, HP-UX, Linux, Solaris, Windows

Reference #:

1987721

Modified date:

2016-08-01

Summary

FileNet Workplace is susceptible to the Open URL Redirection Vulnerability.

Vulnerability Details

Relevant CVE Information:

CVEID:

CVE-2016-5878

DESCRIPTION:

IBM FileNet WorkPlace could allow a remote attacker to conduct phishing
attacks, using an open redirect attack. By persuading a victim to visit a
specially-crafted Web site, a remote attacker could exploit this
vulnerability to spoof the URL displayed to redirect a user to a malicious
Web site that would appear to be trusted. This could allow the attacker to
obtain highly sensitive information or conduct further attacks against the
victim.

CVSS Base Score: 6.8

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/115064

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N)

Affected Products and Versions

FileNet Workplace 4.0.2

Remediation/Fixes

Refer to the Workarounds and Mitigations section below.

Workarounds and Mitigations

First, upgrade to Workplace 4.0.2.14.

Then, to avoid the Open Redirection vulnerability, ensure that only the 
Workplace Baseline URL is used to access pages.

This is configured in the securityFilter.xml file, generally located in the 
install path under the Workplace/WEB-INF directory.

List all applicable Workplace Baseline URLs in the urlWhitelist section. You 
may specify SSL and/or non-SSL URLs.

<value>http://hostname:port/Workplace</value>

<value>https://hostname:port/Workplace</value>

Workplace Baseline URLs that are not included in the urlWhitelist section will
be filtered out and not used.

Get Notified about Future Security Bulletins

Subscribe to

My Notifications

to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

This vulnerability was reported to IBM by Roshan Thomas at secvibe.com

Change History

29 July 2016: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBV6Auaox+lLeg9Ub1AQhndw//X4aVTwnaYrZLeDg7cmNJOjYj7AkBq9Ai
G+b8V7Bz6OZU+OchHhJGTuyIExO6H1WlEg9wqxZXBZcZdukvjBdWty2jdsZwI8C/
gLHS8i7zS6S+Abdc3BmJionr55oe/Tf8wpcvGp0ZJ+4FdtLdHgHBwr0tMnA8EVy2
1m40kOeYyTgnZMrE3hUf32USCt4Hv5cDbhRWo9N8R6yRoyMVeOTHEUDd1/0hTQHW
O54k94OVMUDMgRwSiDqGqcRIdlYsJhc3eZ7nBJCDlGseNhibjdsx3GDMyGXh4Qq8
MjKYg/NWtgjs/kwaby1WvL0s75BhoN/2ZJxZX3ffx8y0+iuBEfyFdtFccpK3ojNw
ReiVtRA55uTyD4KJI9xalh1adCQGQAL3mTLP3UP1td8ztMBXRDMEA/K7u34Sp61M
vxIZGsf2he7lov/GrZEaK/cLFOb0Cy/h2Vch+cwhjLtdzAgxOi6YIfes4EIHB+m6
/iEMb6J8UCw9OE2AKJKGREecio/J3EPr9c+J8o3Gwd43H9gwp37NriXZPcXYFuxz
AhJj3VxJSZiIi4kdr4LKjSjpPD4u/u3Gh269mZL0h8hwqLd2NyEsYTpm+OXYbP8G
j38MdxhtaoWlLP6zQzH2ZBjbSfNDK+ebvQgbo66QgYCEYyE3N0p2xUtX8D3UAYEt
392ir/vguf4=
=BCgf
-----END PGP SIGNATURE-----