Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (CVE-2018-3180, CVE-2018-3139)

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 8 and
IBM® Runtime Environment Java™ Technology Edition, Versions 6, 8 used by IBM Tivoli Netcool Configuration Manager.
These issues were disclosed as part of the IBM Java SDK updates in October 2018.

Vulnerability Details

If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities please refer to the link for “Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition" located in the “References” section for more information.

CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability related to the Java SE JSSE component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151497&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151455&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Tivoli Netcool Configuration Manager 6.4.1.x and 6.4.2.x

Remediation/Fixes

Only standalone OOBC and Worker servers need to be upgraded with the interim fixes listed in the table below.

Product

| VRMF |Remediation/First Fix
—|—|—
ITNCM | 6.4.2 |

Upgrade to 6.4.2-TIV-ITNCM-FP008 in Q2 2018 or apply Apply ITNCM 6.4.2 Fix Pack 7 Interim Fix 01 (6.4.2.7-TIV_ITNCM-IF001) :

ITNCM 6.4.1.4 Interim Fix 10 on Fix Central

ITNCM | 6.4.1 |

Apply ITNCM 6.4.1 Fix Pack 4 Interim Fix 10 (6.4.1.4-TIV-ITNCM-IF010) :

ITNCM 6.4.2.7 Interim Fix 01 on Fix Central

Other ITNCM server configurations use Java as provided by the installed IBM® WebSphere Application Server. Please consult the linked security bulletin “Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2018 CPU” in the references below. Section “For V8.5.0.0 through 8.5.5.14 WebSphere Application Server Traditional and WebSphere Application Server Hypervisor Edition:” applies to ITNCM 6.4.2.x; while section “For V7.0.0.0 through 7.0.0.45 WebSphere Application Server and WebSphere Application Server Hypervisor Edition:” applies to ITNCM 6.4.1.x

Workarounds and Mitigations

None.