Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1337 Multiple vulnerabilities in IBM QRadar SIEM 2 May 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: IBM QRadar SIEM Publisher: IBM Operating System: Linux variants Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated Access Privileged Data -- Existing Account Denial of Service -- Remote/Unauthenticated Cross-site Request Forgery -- Remote with User Interaction Cross-site Scripting -- Remote with User Interaction Reduced Security -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2017-10357 CVE-2017-10356 CVE-2017-10350 CVE-2017-10349 CVE-2017-10348 CVE-2017-10347 CVE-2017-10295 CVE-2017-10281 CVE-2016-3052 CVE-2016-0379 CVE-2015-0176 CVE-2014-1211 Reference: ESB-2015.1095.2 ESB-2014.0071 Original Bulletin: http://www.ibm.com/support/docview.wss?uid=swg22015825 http://www.ibm.com/support/docview.wss?uid=swg22015819 http://www.ibm.com/support/docview.wss?uid=swg22015824 Comment: This bulletin contains three (3) IBM security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- SECURITY BULLETIN: Multiple vulnerabilities in IBM Java Runtime affect IBM QRadar SIEM. Document information More support for: IBM Security QRadar SIEM Software version: 7.2, 7.3 Operating system(s): Linux Software edition: All Editions Reference #: 2015825 Modified date: 30 April 2018 Security Bulletin Summary There are multiple vulnerabilities in IBM(R) Runtime Environment Java(TM) Version 8 used by QRadar SIEM. These issues were disclosed as part of the IBM Java SDK updates in October 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities please refer to the link for "IBM Java SDK Security Bulletin" located in the "References" section for more information. CVEID: CVE-2017-10295 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Networking component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. CVSS Base Score: 4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133729 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) CVEID: CVE-2017-10281 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133720 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10350 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded JAX-WS component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133779 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10347 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, JRockit Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133776 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10349 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded JAXP component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133778 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10348 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133777 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10357 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133786 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2017-10356 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. CVSS Base Score: 6.2 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 133785 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Products and Versions QRadar / QRM / QVM / QRIF / QNI 7.3.0 to 7.3.1 Patch 2 QRadar / QRM / QVM / QRIF / QNI 7.2.0 to 7.2.8 Patch 11 Remediation/Fixes QRadar / QRM / QVM / QRIF / QNI 7.3.1 Patch 3 QRadar / QRM / QVM / QRIF / QNI 7.2.8 Patch 12 Workarounds and Mitigations None Get Notified about Future Security Bulletins Subscribe to My Notifications to be notified of important product support alerts like this. References Complete CVSS v3 Guide On-line Calculator v3 IBM Java SDK Security Bulletin Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Change History 30 April 2018:First Publish *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - --- Security Bulletin: IBM QRadar SIEM contains vulnerable components and libraries. (CVE-2014-1211) Document information More support for: IBM Security QRadar SIEM Software version: 7.2, 7.3 Operating system(s): Linux Software edition: All Editions Reference #: 2015819 Modified date: 30 April 2018 Security Bulletin Summary The product includes vulnerable components (e.g., framework libraries) that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2014-1211 DESCRIPTION: VMware vCloud Director is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input by the Hyper Text Transfer Protocol (http) session management. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities. CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 90560 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) Affected Products and Versions QRadar / QRM / QVM / QRIF / QNI 7.3.0 to 7.3.1 Patch 2 QRadar / QRM / QVM / QRIF / QNI 7.2.0 to 7.2.8 Patch 11 7.3.0-QRADAR-PROTOCOL-VMwarevCloudProtocol-7.3-20161117150303 7.2.0-QRADAR-PROTOCOL-VMwarevCloud-7.2-606255 Remediation/Fixes PROTOCOL-VMwarevCloudProtocol-7.3-20180412195452 PROTOCOL-VMwarevCloud-7.2-20180412155342 Workarounds and Mitigations None Get Notified about Future Security Bulletins Subscribe to My Notifications to be notified of important product support alerts like this. References Complete CVSS v2 Guide On-line Calculator v2 Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgement IBM X-Force Ethical Hacking Team: Ron Craig, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza Change History 24 April 2018:First Publish *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - --- Security Bulletin: IBM QRadar SIEM contains vulnerable components and libraries. (CVE-2015-0176, CVE-2016-0379, CVE-2016-3052) Document information More support for: IBM Security QRadar SIEM Software version: 7.2, 7.3 Operating system(s): Linux Software edition: All Editions Reference #: 2015824 Modified date: 30 April 2018 Security Bulletin Summary The product includes vulnerable components (e.g., framework libraries) that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2015-0176 DESCRIPTION: IBM WebSphere MQ is vulnerable to reflected cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim''s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim''s cookie-based authentication credentials. CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 100941 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVEID: CVE-2016-0379 DESCRIPTION: IBM WebSphere MQ could allow an authenticated user with queue manager rights to cause a denial of service to channels due to incorrect handling of MQ protocol flows. CVSS Base Score: 3.1 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 112245 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2016-3052 DESCRIPTION: IBM WebSphere MQ 8.0 , under nonstandard configurations, sends password data in cleartext over the network that could be intercepted using man in the middle techniques. IBM Reference #: 1998660 CVSS Base Score: 5.9 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/ 114722 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Products and Versions QRadar / QRM / QVM / QRIF / QNI 7.3.0 to 7.3.1 Patch 2 QRadar / QRM / QVM / QRIF / QNI 7.2.0 to 7.2.8 Patch 11 7.3.0-QRADAR-PROTOCOL-MQJMS-7.3-20161104022248 to 20170609093940 7.2.0-QRADAR-PROTOCOL-MQJMS-7.2-20150730145135 to 20151117123141 Remediation/Fixes PROTOCOL-MQJMS-7.3-20180412195445 PROTOCOL-MQJMS-7.2-20180412155328 Workarounds and Mitigations None Get Notified about Future Security Bulletins Subscribe to My Notifications to be notified of important product support alerts like this. References Complete CVSS v2 Guide On-line Calculator v2 Complete CVSS v3 Guide On-line Calculator v3 Related information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgement IBM X-Force Ethical Hacking Team: Ron Craig, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza Change History 24 April 2018:First Publish *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWullSIx+lLeg9Ub1AQis+A/9GaxI8Zic0Jq4zbgsYyyRT9sC23t0e6tf eO3rVBkx1QkCg9n1fa9/nzhLVY9B9mVokOKcZQzHZPFvC2r88PPb8z8SDVJf2ZP3 YaYZ/nTTCojbNTz+OC9URRrrUfmyA4Y25iHFWkHs+m0H/hqprkrSBpMIVMGy9rhi Gm0oIaInFYFAz7wyMNRXMu8Qym7Nt9wKxRFUNgvKhEUTOONhCvyp4w0iK99guNcu QGhNoCX0WwMpmhcYCymhNhUDtETK+gqFIgC/b29ZzY++SnhoewZqfOSM+ikmrsVr gHPPC7KRomoZPIdLAB+6BuLmcIsoG8oeNt07+7ArnT4dBFmV1dAd0Ogy0v1X/obQ rzp8dUOtWXtgH2LJl4ZXylvcUKMWuTXnLsf+UZYD7LB3C2XYsD09eUk3Pxc27mQc GMbJlgiDb305rZLQAmNb616MuLwCY3ORJ1TZerLSanS42V76eMaI/8RT9n2quS+Q mzpDa+61FKI4nxkVFKigKDZ9jc3RxWsD+rcuyya9dLOXZRvp90HGUur8d2jt+3PI daH9ouoDFH4xMiUVcKV3kRMA9oSAp3+Eh8qr5QGnX5247TJJDImstkS/YbaV/Mri IgwmB6D5NQ3/nfFIOfOyeBm+qrEYN3QclyU7vfy7YEEVBi7/p+mH4sVY01UGcMx7 4fxnOgR350I= =dBS9 -----END PGP SIGNATURE-----