Security Bulletin: A vulnerability in IBM Java SDK affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway

Summary

There is a vulnerability in current releases of the IBM® SDK, Java™ Technology Edition that affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway. This issue was disclosed as part of the IBM Java SDK updates in April 2016.

Vulnerability Details

CVEID: CVE-2016-3427** *DESCRIPTION: An unspecified vulnerability related to the JMX component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112459 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Tivoli Federated Identity Manager 6.2
IBM Tivoli Federated Identity Manager Business Gateway 6.2| IBM WebSphere Application Server 6.1
IBM Tivoli Federated Identity Manager 6.2.1
IBM Tivoli Federated Identity Manager Business Gateway 6.2.1| IBM WebSphere Application Server 6.1, 7.0
IBM Tivoli Federated Identity Manager 6.2.2
IBM Tivoli Federated Identity Manager Business Gateway 6.2.2| IBM WebSphere Application Server 6.1, 7.0, 8.0, 8.5

Remediation/Fixes

IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway is affected through IBM WebSphere Application Server. If you use one of the affected versions of WebSphere, update your IBM WebSphere Application Server SDK with the appropriate Interim Fix based on information in the WebSphere security bulletin Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427).