Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY

First Issued: Fri May 6 09:00:55 CDT 2016
|Updated: Wed May 18 16:18:05 CDT 2016
|Update: New Java 6 packages provided with version number 6.0.16.26.
| Fileset levels less than 6.0.0.561 are vulnerable.

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/java_april2016_advisory.asc
https://aix.software.ibm.com/aix/efixes/security/java_april2016_advisory.asc
ftp://aix.software.ibm.com/aix/efixes/security/java_april2016_advisory.asc

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX
CVE-2016-3443 CVE-2016-0687 CVE-2016-0686 CVE-2016-3427 CVE-2016-3449
CVE-2016-3422 CVE-2016-3426 CVE-2016-0264 CVE-2016-0363 CVE-2016-0376

===============================================================================

SUMMARY:

There are multiple vulnerabilities in IBM SDK Java Technology Edition,
Versions 6, 7, 7.1, 8 that are used by AIX. These issues were disclosed
as part of the IBM Java SDK updates in April 2016.

===============================================================================

VULNERABILITY DETAILS:

CVEID: CVE-2016-3443 
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the
    2D component has complete confidentiality impact, complete integrity
    impact, and complete availability impact.
CVSS Base Score: 10 
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112452 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-0687
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE
    Embedded related to the Hotspot component has complete
    confidentiality impact, complete integrity impact, and complete
    availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112455 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-0686
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE
    Embedded related to the Serialization component has complete
    confidentiality impact, complete integrity impact, and complete
    availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112456 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-3427
DESCRIPTION: An unspecified vulnerability in Oracle Java, SE Java SE
    Embedded and JRockit related to the JMX component has complete
    confidentiality impact, complete integrity impact, and complete
    availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112459 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-3449
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the
    Deployment component has complete confidentiality impact, complete
    integrity impact, and complete availability impact.
CVSS Base Score: 7.6
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112453 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-3422
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the
    2D component could allow a remote attacker to cause a denial of
    service resulting in a partial availability impact using unknown
    attack vectors.
CVSS Base Score: 5
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112454 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2016-3426
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE
    Embedded related to the JCE component could allow a remote attacker to
    obtain sensitive information resulting in a partial confidentiality
    impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112457 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID: CVE-2016-0264
DESCRIPTION: A buffer overflow vulnerability in the IBM JVM facilitates
    arbitrary code execution under certain limited circumstances.
CVSS Base Score: 5.6
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/110867 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-0363
DESCRIPTION: IBM SDK, Java Technology Edition contains a vulnerability in
    the IBM ORB implementation that may allow untrusted code running under
    a security manager to elevate its privileges. This vulnerability was
    originally reported as CVE-2013-3009.
CVSS Base Score: 8.1
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112016 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-0376
DESCRIPTION: A vulnerability in IBM Java SDK could allow a remote attacker
    to execute arbitrary code on the system. This vulnerability allows
    code running under a security manager to escalate its privileges by
    modifying or removing the security manager. This vulnerability was
    originally reported as CVE-2013-5456.
CVSS Base Score: 8.1
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112152 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)


AFFECTED PRODUCTS AND VERSIONS:

    AIX 5.3, 6.1, 7.1, 7.2
    VIOS 2.2.x

    The following fileset levels (VRMF) are vulnerable, if the 
    respective Java version is installed:

| For Java6: Less than 6.0.0.561 and including Service Refresh 16,
| Fix Pack 25.
For Java7: Less than 7.0.0.370
For Java7.1: Less than 7.1.0.250
For Java8: Less than 8.0.0.130

    Note:  to find out whether the affected Java filesets are installed 
    on your systems, refer to the lslpp command found in AIX user's guide.

    Example:  lslpp -L | grep -i java


REMEDIATION:

| IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix
| Pack 26 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+(Java+SE)&release=6.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+(Java+SE)&release=6.0.0.0&platform=AIX+64-bit,+pSeries&function=all

    IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix
    Pack 40 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+32-bit,+pSeries&function=all 
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+64-bit,+pSeries&function=all

    IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 3
    Fix Pack 40 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+64-bit,+pSeries&function=all 

    IBM SDK, Java Technology Edition, Version 8 Service Refresh 3
    and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+32-bit,+pSeries&function=all 
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+64-bit,+pSeries&function=all


WORKAROUNDS AND MITIGATIONS:

    None.

===============================================================================

CONTACT US:

If you would like to receive AIX Security Advisories via email,
please visit "My Notifications":

    http://www.ibm.com/support/mynotifications

To view previously issued advisories, please visit:

    http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq

Comments regarding the content of this announcement can be
directed to:

    [email protected]

To obtain the OpenSSL public key that can be used to verify the
signed advisories and ifixes:

    Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team via [email protected] you
can either:

    A. Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt

    B. Download the key from a PGP Public Key Server. The key ID is:

        0x28BFAA12

Please contact your local IBM AIX support center for any
assistance.

REFERENCES:

Complete CVSS v2 Guide:
    http://www.first.org/cvss/v2/guide 
On-line Calculator v2:
    http://nvd.nist.gov/CVSS-v2-Calculator 
Complete CVSS v3 Guide:
    http://www.first.org/cvss/user-guide 
On-line Calculator v3:
    http://www.first.org/cvss/calculator/3.0 
IBM Java SDK Security Bulletin:
    http://www-01.ibm.com/support/docview.wss?uid=swg21980826

ACKNOWLEDGEMENTS:

CVE-2016-0363 and CVE-2016-0376 were reported by Adam Gowdiak of
Security Explorations. 

CHANGE HISTORY:

First Issued: Fri May  6 09:00:55 CDT 2016
Updated: Wed May 11 09:31:56 CDT 2016
Update: New Java 6 packages provided with version number 6.0.16.26.

| Updated: Wed May 18 16:18:05 CDT 2016
| Update: New Java 6 packages provided with version number 6.0.16.26.
| Fileset levels less than 6.0.0.561 are vulnerable.

===============================================================================

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an “industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.