Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Data Studio Web Console. (CVE-2014-6457, CVE-2014-3065)

Summary

There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 5, 6 and 7, which are used by IBM Data Studio Web Console (DSWC). These issues were disclosed as part of the IBM Java SDK updates in October 2014.

Vulnerability Details

CVE-ID: CVE-2014-3065 DESCRIPTION: IBM Java SDK contains a vulnerability in which the default configuration for the shared classes feature potentially allows arbitrary code to be injected into the shared classes cache, which may subsequently be executed by other local users.
CVSS Base Score: 6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/93629&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:C/I:C/A:C)

CVE ID: CVE-2014-6457 DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS: CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/97148&gt;
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

Affected Products and Versions

IBM Data Studio Web Console, versions 2.2, 3.1, 3.1.1, 3.2, 4.1 and 4.1.1**.**

Remediation/Fixes

The fix for this vulnerability requires the upgrade of the IBM Java Runtime that is installed with DSWC. Install one of the following IBM Java Runtime versions:

• IBM Java Runtime, Java 2 Technology Edition, Version 5.0 Service Refresh 16 Fix Pack 8 and subsequent releases
• IBM Java Runtime, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 2 and subsequent releases
• IBM Java Runtime, Java Technology Edition, Version 6R1 Service Refresh 8 Fix Pack 2 and subsequent releases
• IBM Java Runtime, Java Technology Edition, Version 7 Service Refresh 8 and subsequent releases
• IBM Java Runtime, Java Technology Edition, Version 7R1 Service Refresh 2 and subsequent releases

Detailed instructions are provided in the tech-note “Updating the IBM Runtime Environment, Java™ Technology Edition for IBM Data Studio web console”.

Workarounds and Mitigations

None.

**