Security Bulletin: Potential security vulnerabilities with JavaTM SDKs

Security Bulletin


Summary

Smarter Infrastructure Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs.

Vulnerability Details

CVE IDs: CVE-2013-5456 CVE-2013-5457 CVE-2013-5458 CVE-2013-4041 CVE-2013-5375 CVE-2013-5372 CVE-2013-5843 CVE-2013-5789 CVE-2013-5830 CVE-2013-5829 CVE-2013-5787 CVE-2013-5788 CVE-2013-5824 CVE-2013-5842 CVE-2013-5782 CVE-2013-5817 CVE-2013-5809 CVE-2013-5814 CVE-2013-5832 CVE-2013-5850 CVE-2013-5838 CVE-2013-5802 CVE-2013-5812 CVE-2013-5804 CVE-2013-5783 CVE-2013-3829 CVE-2013-5823 CVE-2013-5831 CVE-2013-5820 CVE-2013-5819 CVE-2013-5818 CVE-2013-5848 CVE-2013-5776 CVE-2013-5774 CVE-2013-5825 CVE-2013-5840 CVE-2013-5801 CVE-2013-5778 CVE-2013-5851 CVE-2013-5800 CVE-2013-5784 CVE-2013-5849 CVE-2013-5790CVE-2013-5780 CVE-2013-5797 CVE-2013-5803 CVE-2013-5772
DESCRIPTION: Customers who have Java based applications, such as Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions (including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities), Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, Change and Configuration Management Database, SmartCloud Control Desk, Intelligent Building Management, or TRIRIGA for Energy Optimization are potentially impacted by these vulnerabilities, which can cause issues related to confidentiality, integrity, and availability. For additional information including the most current description and CVSS for each vulnerability, please refer to developerWorks JavaTM Technology Security Alerts.

There are a number of vulnerabilities in the IBM SDK, Java Technology Edition that affect various components. CVE-2013-5456, CVE-2013-5457 and CVE-2013-5458 allow code running under a security manager to escalate its privileges by modifying or removing the security manager. CVE-2013-4041 and CVE-2013-5375 allow code running under a security manager to access restricted classes. These vulnerabilities could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a web browser for running applets and Web Start applications.

CVE-2013-5372 is a denial of service vulnerability which could result in a complete availability impact on the affected system.

This bulletin also covers all applicable CVEs published by Oracle as part of their October 2013 Java SE Critical Patch Update. For more information please refer to Oracle's October 2013 Java SE CPU Advisory.

CVE ID DESCRIPTION
CVE-2013-3829
CVSS Base Score: 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87986
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries
CVE-2013-4041
CVSS Base Score: 6.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86416
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Unspecified vulnerability in IBM Java SDK could allow access to restricted classes. This vulnerability could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a Web browser for running Applets and Web Start applications
CVE-2013-5372
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86662
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Unspecified vulnerability in the JRE component allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities
CVE-2013-5375
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86901
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Unspecified vulnerability in IBM Java SDK could allow access to restricted classes. This vulnerability could occur when untrusted code is executed under a security manager, or when the IBM SDK, Java Technology Edition has been associated with a Web browser for running Applets and Web Start applications
CVE-2013-5456
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88255
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager
CVE-2013-5457
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88256
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager
CVE-2013-5458
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88257
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Unspecified vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager
CVE-2013-5772
CVSS Base Score: 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88007
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/H:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to jhat
CVE-2013-5774
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87999
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Libraries
CVE-2013-5776
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87992
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment
CVE-2013-5778
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87990
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE allows remote attackers to affect confidentiality via unknown vectors related to 2D
CVE-2013-5780
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88001
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries
CVE-2013-5782
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87960
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D
CVE-2013-5783
CVSS Base Score: 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87987
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing
CVE-2013-5784
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88005
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to SCRIPTING
CVE-2013-5787
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87967
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
CVE-2013-5788
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87966
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
CVE-2013-5789
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87968
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
CVE-2013-5790
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88004
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to BEANS
CVE-2013-5797
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88006
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/S:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote authenticated users to affect integrity via unknown vectors related to Javadoc
CVE-2013-5800
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88002
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to JGSS
CVE-2013-5801
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87991
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to 2D
CVE-2013-5802
CVSS Base Score: 7.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87982
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/P)
Unspecified vulnerability in JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP
CVE-2013-5803
CVSS Base Score: 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88008
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/H:Au/N:C/N:I/N:A/P)
Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to JGSS
CVE-2013-5804
CVSS Base Score: 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87984
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc
CVE-2013-5809
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87962
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D
CVE-2013-5812
CVSS Base Score: 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87985
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/P)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment
CVE-2013-5814
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87964
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA
CVE-2013-5817
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87969
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI
CVE-2013-5818
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87993
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment
CVE-2013-5819
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87994
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment
CVE-2013-5820
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87996
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to JAX-WS
CVE-2013-5823
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87989
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/N:A/P)
Unspecified vulnerability in the JRE component allows remote attackers to affect availability via unknown vectors related to Security
CVE-2013-5824
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87965
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
CVE-2013-5825
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87988
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/N:A/P)
Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to JAXP
CVE-2013-5829
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87963
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D
CVE-2013-5830
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87961
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries
CVE-2013-5831
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87995
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment
CVE-2013-5832
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87972
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
CVE-2013-5838
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87974
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries
CVE-2013-5840
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87998
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries
CVE-2013-5842
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87970
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries
CVE-2013-5843
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87971
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D
CVE-2013-5848
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88000
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment
CVE-2013-5849
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88003
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to AWT
CVE-2013-5850
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87973
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/C:I/C:A/C)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries
CVE-2013-5851
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87997
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/N:A/N)
Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to JAXP

The developerWorks JavaTM Technology Security Alerts includes a link to Oracle's October 2013 Critical Patch Update.

Affected Products and Versions

The following IBM Java versions are affected:
· IBM SDK Java Technology Edition Version 7***

· IBM SDK Java Technology Edition Version 6

· IBM SDK Java Technology Edition Version 5

· IBM SDK Java Technology Edition Version 1.4.2

Note that the following Oracle Java versions, which are not IBM products, are affected: Java SE JDK and JRE Version 7 Update 7 and earlier, Java SE JDK and JRE Version 6 Update 35 and earlier, Java SEJDK and JRE Version 5 Update 36 and earlier, and Java SE JDK and JRE Version 1.4.2_38 and earlier.

IBM supplied the Java Runtime Environment (JRE) from the IBM SDK Java Technology Edition Versions with the following:

The 7.1.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.

The 7.2.x versions of Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.

The 7.5.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, and SmartCloud Control Desk bundled the JRE from IBM SDK Java Technology Edition Version 6.

Intelligent Building Management 1.1.x and TRIRIGA for Energy Optimization 1.1.x bundled the JRE from IBM SDK Java Technology Edition Version 6.

It is likely that earlier unsupported versions are also affected by these vulnerabilities. Remediation is not provided for product versions that are no longer supported. IBM recommends that customers running unsupported versions upgrade to the latest supported version of products in order to obtain remediation for the vulnerabilities.
***Please note that the versions of the IBM products listed above do not bundle JRE Version 7 or IBM SDK Java Technology Edition Version 7; however, JRE Version 7 and IBM SDK Java Technology Edition Version 7 are listed here because JRE Version 7 is prevalent on the browser and therefore can potentially impact access to these IBM product versions

Remediation/Fixes

VENDOR FIXES:
There are two areas where the vulnerabilities in the Java SDK/JDK or JRE may require remediation:
1. Application Server – Update the Websphere Application Server. Refer to JDK Fixes for Websphere Application Server for additional information on updating and maintaining the JDK component within Websphere. Customers with Oracle Weblogic Server, which is not an IBM product and is not shipped by IBM, will also want to update their server.
2. Browser Client - Update the Java plug-in used by the browser on client systems, using the remediated JRE version referenced on developerWorks JavaTM Technology Security Alerts or referenced on Oracle’s latest Critical Patch Update (which can be accessed via developerWorks JavaTM Technology Security Alerts). Updating the browser Java plug-in may impact some applets such as Maximo Asset Management Scheduler. Download from IBM FixCentral the latest Maximo Asset Management Scheduler Interim Fix for Version 7.1 or the latest Maximo Asset Management Fix Pack for Version 7.5, which includes the resolution for APAR IV11560.

Due to the threat posed by a successful attack, IBM strongly recommends that customers apply fixes as soon as possible.

Workarounds and Mitigations

Until you apply the fixes, it may be possible to reduce the risk of successful attack by restricting network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from unprivileged users may help reduce the risk of successful attack. Both approaches may break application functionality, so IBM strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.

References

Complete CVSS Guide
On-line Calculator V2
Complete CVSS Guide
On-line Calculator V2
X-Force Vulnerability Database
Oracle October 2013 Java SE Critical Patch Update Advisory
IBM SDK, Java Technology Edition Security Alerts

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note:
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION:
IBM Product Security Incident Reporting Team

ACKNOWLEDGEMENTS:
The vulnerabilities described by the following CVEs were reported to IBM by Adam Gowdiak of Security Explorations: CVE-2013-5456, CVE-2013-5457, and CVE-2013-5458.

Change History
13 Dec 2013 Flash published

CROSS REFERENCE INFORMATION:

Segment Product Component/Platform Version
Systems and Asset Management Maximo Asset Management All 7.1.1.0 – 7.1.1.12
7.5.0.0 – 7.5.0.5
Systems and Asset Management Maximo Asset Management Essentials All 7.1.1.0 – 7.1.1.12
7.5.0.0 – 7.5.0.5
Systems and Asset Management Maximo Asset Management for Energy Optimization All 7.1.0.0 – 7.1.1.0
Systems and Asset Management Maximo for Government All 7.1.0.0
7.5.0.0
Systems and Asset Management Maximo for Nuclear Power All 7.1.0.0 – 7.1.1.0
7.5.0.0 – 7.5.1.0
Systems and Asset Management Maximo for Transportation All 7.1.0.0 – 7.1.1.0
7.5.0.0 – 7.5.1.0
Systems and Asset Management Maximo for Life Sciences All 7.1.0.0 – 7.1.2.0
7.5.0.0
Systems and Asset Management Maximo for Oil and Gas All 7.1.0.0 – 7.1.2.0
7.5.0.0 – 7.5.1.0
Systems and Asset Management Maximo for Utilities All 7.1.0.0 – 7.1.2.0
7.5.0.0
Systems and Asset Management Tivoli Service Request Manager All 7.1.0.0 – 7.1.1.12
7.2.0.0 – 7.2.1.3
Systems and Asset Management Tivoli Asset Management for IT All 7.1.0.0 – 7.1.1.12
7.2.0.0 – 7.2.2.1
Systems and Asset Management Change and Configuration Management Database All 7.1.0.0 – 7.1.1.12
7.2.0.0 – 7.2.1.2
Systems and Asset Management Intelligent Building Management All 1.1.0.0
Systems and Asset Management TRIRIGA for Energy Optimization All 1.1.0.0
Systems and Asset Management SmartCloud Control Desk All 7.5.0.0 – 7.5.1.1

Related information

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.


Cross reference information
Segment Product Component Platform Version Edition
Systems and Asset Management IBM Maximo Asset Management Essentials
Systems and Asset Management IBM Maximo Asset Management for Energy Optimization
Systems and Asset Management IBM Maximo for Government
Systems and Asset Management IBM Maximo for Nuclear Power
Systems and Asset Management IBM Maximo for Transportation
Systems and Asset Management IBM Maximo for Life Sciences
Systems and Asset Management IBM Maximo for Oil and Gas
Systems and Asset Management IBM Maximo for Utilities
Systems and Asset Management Tivoli Service Request Manager
Systems and Asset Management Tivoli Asset Management for IT
Systems and Asset Management Tivoli Change and Configuration Management Database
Systems and Asset Management IBM TRIRIGA Energy Optimization
Systems and Asset Management IBM SmartCloud Control Desk

Document information


More support for:

Maximo Asset Management

Software version:

7.1, 7.1.1, 7.1.2, 7.2, 7.2.1, 7.5

Operating system(s):

Platform Independent

Reference #:

1660039

Modified date:

2014-03-31

Translate my page

Content navigation