Security Bulletin: Vulnerability in IBM Java SDKs and IBM Java Runtime Technology Edition affecting Rational Functional Tester (CVE-2014-3086)

Summary

Multiple vulnerabilities exist in IBM SDKs Java Technology Edition and IBM Runtime Environment Java Technology Edition that are used by Rational Functional Tester (RFT). These issues were disclosed as part of the IBM Java SDK updates in July 2014.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVEID: CVE-2014-3086

Description: A vulnerability in the IBM implementation of the Java Virtual Machine may, under very limited circumstances, allow untrusted code running under a security manager to escalate its privileges.

CVSS Base Score: 9.3 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94097&gt;
for the current score
CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Affected Products and Versions

Rational Functional Tester version 8.2.2 and later

Remediation/Fixes

Vendor Fixes:

Workarounds and Mitigations

Until fixes are applied, ensure RFT is not accessible from the Internet.