Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server July 2014 CPU

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014.

Vulnerability Details

The following three advisories are included in the IBM® SDK Java™ Technology Edition and WebSphere Application Server may be vulnerable to them.

CVEID: CVE-2014-4263**
DESCRIPTION:** An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact and no availability impact.
CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94606 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVEID: CVE-2014-4244**
DESCRIPTION:** An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact and no availability impact.
CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94605 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVEID:CVE-2014-3068
DESCRIPTION: A vulnerability in the Java Certificate Management System (CMS) keystore provider potentially allows brute-force private key recovery from CMS keystores.
CVSS Base Score: 2.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/93756 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:P/I:P/A:N)

The following advisories are included in the IBM Java SDK but WebSphere Application Server is not vulnerable to them. You will need to evaluate your own code to determine if you are vulnerable. Please refer to the Reference section for more information on the advisories not applicable to WebSphere Application Server:
CVE IDs:
CVE-2014-4227
CVE-2014-4262
CVE-2014-4216
CVE-2014-2490
CVE-2014-4223
CVE-2014-4219
CVE-2014-2483
CVE-2014-4209
CVE-2014-4220
CVE-2014-4268
CVE-2014-4218
CVE-2014-4252
CVE-2014-4252
CVE-2014-4266
CVE-2014-4262
CVE-2014-4265
CVE-2014-4221
CVE-2014-4208
CVE-2014-3086

Affected Products and Versions

• IBM Java SDK shipped with IBM WebSphere Application Server Version 8.5.0.0 through 8.5.5.2, Version 8.0.0.0 through 8.0.0.9, Version 7.0.0.0 through 7.0.0.33, Version 6.1.0.0 through 6.1.0.47
• This does not occur on IBM Java SDK shipped with WebSphere Application Servers Fix Packs 8.5.5.4, 8.0.0.10 and 7.0.0.35 or later.
• Warning:
  For mixed cells that contain WebSphere Application Server version 6.0.2 nodes where Java 2 security is enabled, ensure APAR PM92206 or its circumvention is applied to the Deployment Manager to prevent sync operation failure. PM92206 has been delivered with an Interim Fix or with WebSphere Application Server Fix Packs 8.5.5.1 and 8.0.0.7 and 7.0.0.31 or later.

Remediation/Fixes

For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition****:

Download and apply the interim fix APARs below, for your appropriate release:

For V8.5.0.0 through 8.5.5.2 Full Profile:

• Apply Interim Fix PI20795: Will upgrade you to IBM Java SDK Version 7R1 Service Refresh 1 Fix Pack 1 (optional)

• Apply Interim Fix PI20796: Will upgrade you to IBM Java SDK Version 7 Service Refresh 7 Fix Pack 1 (optional)

• Apply Interim Fix PI20797: Will upgrade you to IBM Java SDK Version 6R1 Service Refresh 8 Fix Pack 1 (required)
  --OR–

• Apply IBM Java SDK shipped with the WebSphere Application Server Fix pack 8.5.5.4 or later.
  **
  For 8.0.0.0 through 8.0.0.9:**

• Apply Interim Fix PI20798: Will upgrade you to IBM Java SDK Version 6R1 Service Refresh 8 Fix Pack 1
  --OR–

• Apply IBM Java SDK shipped with WebSphere Application Server Fix pack 10 (8.0.0.10) or later.
  **
  For V7.0.0.0 through 7.0.0.33:**

• Apply Interim Fix PI20799: Will upgrade you to IBM Java SDK Version 6 Service Refresh 16 Fix Pack 1
  --OR–

• Apply IBM Java SDK shipped with WebSphere Application Server Fix pack 35 (7.0.0.35) or later.
  **
  For V6.1.0.0 through 6.1.0.47:**

• Contact IBM Support and apply Interim Fix PI20800: Will upgrade you to IBM Java SDK Version 5.0 Service Refresh 16 Fix Pack 7
  _
  For IBM WebSphere Application Server for i5/OS operating systems:_

The IBM Developer Kit for Java is prerequisite software for WebSphere Application Server for IBM i. Please refer to Java on IBM i for updates on when these fixes will be available.