Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2121
IBM JRE patched in IBM Cognos Business Intelligence
20 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Cognos Business Intelligence
IBM Cognos Metrics Manager
Publisher: IBM
Operating System: AIX
HP-UX
Linux variants
Solaris
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote with User Interaction
Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-2814 CVE-2018-2800 CVE-2018-2799
CVE-2018-2798 CVE-2018-2797 CVE-2018-2796
CVE-2018-2795 CVE-2018-2790 CVE-2018-2783
CVE-2018-2678 CVE-2018-2677 CVE-2018-2663
CVE-2018-2657 CVE-2018-2637 CVE-2018-2634
CVE-2018-2618 CVE-2018-2603 CVE-2018-2599
CVE-2018-2588 CVE-2018-2579 CVE-2018-1413
CVE-2018-0739 CVE-2017-15095 CVE-2017-12624
CVE-2017-7525 CVE-2017-3737 CVE-2017-3736
CVE-2017-3735
Reference: ASB-2018.0162
ESB-2018.0207
ESB-2018.0205
ESB-2017.3028
ESB-2017.2662
ESB-2017.1863
Original Bulletin:
https://www.ibm.com/support/docview.wss?uid=ibm10715641
https://www.ibm.com/support/docview.wss?uid=ibm10713459
Comment: This bulletin contains two (2) IBM security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: IBM Cognos Business Intelligence Server 2018Q2 Security
Updater : IBM Cognos Business Intelligence Server is affected by multiple
vulnerabilities
Security Bulletin
Document information
Software version: 10.2.0, 10.2.1, 10.2.1.1, 10.2.2
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Reference #: 0715641
Modified date: 19 July 2018
Summary
This bulletin addresses several security vulnerabilities that are fixed in IBM
Cognos Business Intelligence.
There are multiple vulnerabilities in IBM Runtime Environment Java Technology
Edition, Version 6 and IBM Runtime Environment Java Technology Edition,
Version 7 that are used by IBM Cognos Business Intelligence. These issues were
disclosed as part of the IBM Java SDK updates in January and April 2018.
Multiple Open Source OpenSSL vulnerabilities affect IBM Cognos Business
Intelligence versions prior to 10.2.2.
IBM Cognos Business Intelligence uses the IBM WAS Liberty Profile (WLP). There
is a potential denial of service in Apache CXF that is used by WebSphere
Application Server . IBM Cognos Business Intelligence has upgraded WLP to a
version that addresses the vulnerability.
A deserialization flaw was discovered in the jackson-databind library which is
used by IBM Cognos Business Intelligence.
IBM Cognos Business Intelligence is vulnerable to Cross-Site Scripting (XSS)
where the application allows a users input to be integrated with client-side
application code in an unsafe manner.
Vulnerability Details
If you run your own Java code using the IBM Java Runtime delivered with this
product, you should evaluate your code to determine whether the complete list
of vulnerabilities are applicable to your code. For a complete list of
vulnerabilities please refer to the link for "IBM Java SDK Security Bulletin"
located in the References section for more information.
CVEID: CVE-2017-3735
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an error while parsing an IPAdressFamily extension in an
X.509 certificate. An attacker could exploit this vulnerability to trigger an
out-of-bounds read, resulting in an incorrect text display of the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
131047 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVEID: CVE-2017-3736
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a carry propagation flaw in the x86_64 Montgomery
squaring function bn_sqrx8x_internal(). An attacker with online access to an
unpatched system could exploit this vulnerability to obtain information about
the private key.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
134397 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2018-0739
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially
crafted ASN.1 data with a recursive definition, a remote attacker could exploit
this vulnerability to consume excessive stack memory.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
140847 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2017-3737
DESCRIPTION: An unspecified vulnerability in multiple Oracle products could
allow an unauthenticated attacker to cause low confidentiality impact, low
integrity impact, and high availability impact.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
136077 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2017-7525
DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary
code on the system, caused by a deserialization flaw within the Jackson JSON
library in the readValue method of the ObjectMapper. By sending a
specially-crafted request, an attacker could exploit this vulnerability to
execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
134639 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2017-12624
DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a
specially crafted message attachment header, a remote attacker could exploit
this vulnerability to cause the AX-WS and JAX-RS services stop responding.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
135095 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2017-15095
DESCRIPTION: Jackson Library could allow a remote attacker to execute arbitrary
code on the system, caused by a deserialization flaw in the readValue() method
of the ObjectMapper. By sending specially crafted data, an attacker could
exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
135123 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-1413
DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This
vulnerability allows users to embed arbitrary JavaScript code in the Web UI
thus altering the intended functionality potentially leading to credentials
disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
138819 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVEID: CVE-2018-2579
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown attack
vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137833 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-2588
DESCRIPTION: An unspecified vulnerability related to the Java SE LDAP component
could allow an authenticated attacker to obtain sensitive information resulting
in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137841 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-2663
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137917 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2677
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137932 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2678
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137933 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2599
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI component
could allow an unauthenticated attacker to cause no confidentiality impact, low
integrity impact, and low availability impact.
CVSS Base Score: 4.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVEID: CVE-2018-2603
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137855 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2657
DESCRIPTION: An unspecified vulnerability related to the Java SE Serialization
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137910 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2618
DESCRIPTION: An unspecified vulnerability related to the Java SE JCE component
could allow an unauthenticated attacker to obtain sensitive information
resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137870 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2018-2634
DESCRIPTION: An unspecified vulnerability related to the Java SE JGSS component
could allow an unauthenticated attacker to obtain sensitive information
resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137886 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-2637
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause high confidentiality impact,
high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-2800
DESCRIPTION: An unspecified vulnerability related to the Java SE RMI component
could allow an unauthenticated attacker to cause low confidentiality impact,
low integrity impact, and no availability impact.
CVSS Base Score: 4.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141956 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVEID: CVE-2018-2795
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141951 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2796
DESCRIPTION: An unspecified vulnerability related to the Java SE Concurrency
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141952 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2797
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141953 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2798
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141954 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2799
DESCRIPTION: An unspecified vulnerability related to the Java SE JAXP component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141955 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2783
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause high confidentiality
impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-2814
DESCRIPTION: An unspecified vulnerability related to the Java SE VM component
could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141970 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVEID: CVE-2018-2790
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and no availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141946 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected Products and Versions
IBM Cognos Business Intelligence Server 10.2.2
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2.0
Remediation/Fixes
The recommended solution is to apply the fix for versions listed as soon as
practical.
Cognos Business Intelligence 10.2.x interim fixes address a security
vulnerability - 2018/Q2
Workarounds and Mitigations
None
Acknowlegement
CVE-2018-1413: The vulnerability was reported to IBM by Jarad Kopf
Change History
19 July 2018: Original Version Published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: IBM Cognos Metrics Manager 2018 Q2 Security Update: IBM
Cognos Metrics Manager is affected by multiple vulnerabilities.
Security Bulletin
Document information
Software version: 10.2, 10.2.1, 10.2.2
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Reference #: 0713459
Modified date: 19 July 2018
Summary
This bulletin addresses several security vulnerabilities that are fixed in IBM
Cognos Metrics Manager.
IBM Cognos Metrics Manager consumes OpenSSL. Multiple vulnerabilities have been
addressed in OpenSSL.
There are multiple vulnerabilities in IBM? Runtime Environment Java? Technology
Edition, Version 6 and IBM? Runtime Environment Java? Technology Edition,
Version 7 that are used by IBM Cognos Metrics Manager. These issues were
disclosed as part of the IBM Java SDK updates in January 2018 and April 2018.
Vulnerability Details
If you run your own Java code using the IBM Java Runtime delivered with this
product, you should evaluate your code to determine whether the complete list
of vulnerabilities are applicable to your code. For a complete list of
vulnerabilities please refer to the link for ?IBM Java SDK Security Bulletin"
located in the ?References? section for more information.
CVEID: CVE-2018-0739
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially
crafted ASN.1 data with a recursive definition, a remote attacker could exploit
this vulnerability to consume excessive stack memory.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
140847 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2017-3736
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a carry propagation flaw in the x86_64 Montgomery
squaring function bn_sqrx8x_internal(). An attacker with online access to an
unpatched system could exploit this vulnerability to obtain information about
the private key.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
134397 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2017-3735
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an error while parsing an IPAdressFamily extension in an
X.509 certificate. An attacker could exploit this vulnerability to trigger an
out-of-bounds read, resulting in an incorrect text display of the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
131047 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVEID: CVE-2017-3738
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. An attacker could
exploit this vulnerability to obtain information about the private key. Note:
In order to exploit this vulnerability, the server would have to share the
DH1024 private key among multiple clients, which is no longer an option since
CVE-2016-0701.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
136078 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2017-3737
DESCRIPTION: OpenSSL could allow a remote attacker to bypass security
restrictions, caused by a flaw in the "error state" mechanism when directly
calling SSL_read() or SSL_write() for an SSL object after receiving a fatal
error. An attacker could exploit this vulnerability to bypass the decryption or
encryption process and perform unauthorized actions.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
136077 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2018-2633
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI component
could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137885 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVEID: CVE-2018-2637
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause high confidentiality impact,
high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-2634
DESCRIPTION: An unspecified vulnerability related to the Java SE JGSS
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a high confidentiality impact using unknown attack
vectors.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137886 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-2657
DESCRIPTION: An unspecified vulnerability related to the Java SE,
Serialization component could allow an unauthenticated attacker to cause a
denial of service resulting in a low availability impact using unknown attack
vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137910 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2603
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137855 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2602
DESCRIPTION: An unspecified vulnerability related to the Java SE I18n
component could allow an unauthenticated attacker to cause low confidentiality
impact, low integrity impact, and low availability impact.
CVSS Base Score: 4.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137854 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVEID: CVE-2018-2678
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137933 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2677
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137932 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2663
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137917 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2579
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown attack
vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137833 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-2783
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause high confidentiality
impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-2799
DESCRIPTION: An unspecified vulnerability related to the Java SE JAXP
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141955 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2798
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141954 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2797
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141953 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2796
DESCRIPTION: An unspecified vulnerability related to the Java SE Concurrency
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141952 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2795
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141951 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-2800
DESCRIPTION: An unspecified vulnerability related to the Java SE RMI component
could allow an unauthenticated attacker to cause low confidentiality impact,
low integrity impact, and no availability impact.
CVSS Base Score: 4.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141956 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVEID: CVE-2018-2790
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and no availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141946 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected Products and Versions
* IBM Cognos Metrics Manager 10.2.2
* IBM Cognos Metrics Manager 10.2.1
* IBM Cognos Metrics Manager 10.2
Remediation/Fixes
The recommended solution is to apply the fix as soon as practical. As the fix
is in a shared component across the Business Intelligence portfolio, applying
the BI Interim Fix will resolve the issue. Note that the prerequisites named in
the links are also satisfied by an IBM Cognos Metrics Manager install of the
same version.
+------------------------------------------------------------------------------------------------------------------+
| |Version |Interim Fix |
|---------------------------------+---------+----------------------------------------------------------------------|
|IBM Cognos Metrics Manager |10.2.2 |IBM Cognos Business Intelligence 10.2.2 Interim Fix 19 |
|---------------------------------+---------+----------------------------------------------------------------------|
|IBM Cognos Metrics Manager |10.2.1 |IBM Cognos Business Intelligence 10.2.1 Interim Fix 24 |
|---------------------------------+---------+----------------------------------------------------------------------|
|IBM Cognos Metrics Manager |10.2 |IBM Cognos Business Intelligence 10.2 Interim Fix 27 |
+------------------------------------------------------------------------------------------------------------------+
Workarounds and Mitigations
None
Change History
19 July 2018: Original Version Published
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW1GHxmaOgq3Tt24GAQhD/A//QD2Ul9e0748tpzb5OvNzeNqmeckcWGoj
Zh8dZxyLeVleqL+Xr4BtcflH0mU+dVLPZ3ym/RylQ+iGKhl9C7A7ETIg/jiAVJu1
Pg1jxwmg9bt9RSwto9xqEffPcEJQS2ZWR0+A9RFYC3ssxcxSe8iCdshq3uBGqMEL
TXn1O9RYv/vig69/ZiXq8O2QYKLGEAT0gSrofauV926/l7I/FZcI4HiFK7DbuF1B
cDjVJgXxrtormhhGpeLJ9I/d3f6ThUXBBC093FezqB2FkD5zUpMpg+PKF9Joi7rc
9n5f/uZCQrS2b9noJuHu/n4E0hKIuWJ0mBYPWj8xO0hwIZE7+epUEoOEaLDHU75v
CgElOCRzm4s1ZbjhROUlMYpgxBjbkm9Y0Cui8hW8LcuLH/Ci9gEVLqqO5fF4ouNk
TjoX/mLL44pMfgVk8s0WSzRKtHQMg+OrvPRJCpzwMwjQBXvoo1h+A81ZfB7oFSJu
pOGRDZ1cIdYdN/q7qR48bXKaJbv9GhOk6oX0umdxodh2UkvSDhDHMvX2loSeatT3
X1ocT02TzP1ymxinGG2yF/Dzl4WZcui2jGKkh14WGoOhpFGuO1UZhUAzaWSMqo8D
18LI0y0N/2HC7LKFM3IqVKv0ZcdwEi9DakG/W297/obT5DJNS5TQpf1tBzBZQG+1
8jFOz1rA4Po=
=bEQk
-----END PGP SIGNATURE-----