Lucene search

K
ibmIBM0CD3C55D23EF6A3854413D6B77B0308F73405F8CB242F8337158678FAB58DBC5
HistoryJun 15, 2018 - 10:45 p.m.

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo Credit Limits (CVE-2016-3092)

2018-06-1522:45:37
www.ibm.com
8

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

Summary

Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component, and is supplied with IBM Algo Credit Limits. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive.

Vulnerability Details

CVE-ID: CVE-2016-3092
Description: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive.
CVSS Base Score: 5.300
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/114336&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM Algo Credit Limits 4.7 and earlier

Remediation/Fixes

A fix has been created for version 4.5.0.05 and 4.7.0.03 of the named product. Download and install the fix as soon as practicable. Fix and installation instructions are provided at the URL listed below.

Patch Number Download URL
ACLM 4.7.0.03 FP10 Solaris/Oracle http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Information+Management&product=ibm/Information+Management/Algo+Credit+Manager&release=All&platform=All&function=fixId&fixids=4.7.0.03-Algo-CreditLimits-SolOra-fp0010:0&includeSupersedes=0&source=fc&login=true
ACLM 4.7.0.03 FP10 Solaris/DB2 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Information+Management&product=ibm/Information+Management/Algo+Credit+Manager&release=All&platform=All&function=fixId&fixids=4.7.0.03-Algo-CreditLimits-SolDB2-fp0010:0&includeSupersedes=0&source=fc&login=true
ACLM 4.7.0.03 FP10 RHEL/Oracle http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Information+Management&product=ibm/Information+Management/Algo+Credit+Manager&release=All&platform=All&function=fixId&fixids=4.7.0.03-Algo-CreditLimits-RHESOra-fp0010:0&includeSupersedes=0&source=fc&login=true
ACLM 4.7.0.03 FP10 AIX/Oracle http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Information+Management&product=ibm/Information+Management/Algo+Credit+Manager&release=All&platform=All&function=fixId&fixids=4.7.0.03-Algo-CreditLimits-AIXOra-fp0010:0&includeSupersedes=0&source=fc&login=true
ACLM-TFOLC 4.5.0.05 IF9 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Information+Management&product=ibm/Information+Management/Algo+Credit+Manager&release=All&platform=All&function=fixId&fixids=4.5.0.5-Algo-CreditLimits-if0009-cs:0&includeSupersedes=0&source=fc&login=true

Workarounds and Mitigations

None

CPENameOperatorVersion
algo credit limitseq4.7.0

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

Related for 0CD3C55D23EF6A3854413D6B77B0308F73405F8CB242F8337158678FAB58DBC5