There is a potential denial of service with WebSphere Application Server versions 6.0.2 and 6.1. These affected versions of WebSphere Application Server are supported for use with IBM Tivoli Security Policy Manager.
CVEID: _
CVE-2014-0964_
DESCRIPTION:
There is a potential denial of service in IBM WebSphere Application Server versions 6.0.2 and 6.1. If you run a Heartbleed scanning tool or send specially crafted Heartbeat messages to the server, it can cause the IBM SDK for Java for WebSphere Application Server to become stuck in a processing loop resulting in high CPU usage. If enough processing loops are generated, the server may become unresponsive and require a server restart. There is no impact to confidentiality or integrity.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92877 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C)
Please check your WebSphere version to determine if you are using one of the affected versions.
If you are running one of the affected WebSphere versions listed in the Affected Products section above, update your IBM WebSphere Application Server with the appropriate Interim Fix based on information in the WebSphere security bulletin link below.
Product | Remediation/First Fix |
---|---|
TSPM 7.0, 7.1 | PI16981 _(For __WebSphere _6.1.0.0 through 6.1.0.47) |
If customers are using Heartbleed tools to detect the OpenSSL Heartbleed vulnerability they should stop using the tool.