Security Bulletin: Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254)

Summary

There is an XML External Entity Injection (XXE) vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server.

Vulnerability Details

CVEID: CVE-2015-0254**
DESCRIPTION:** Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101550 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

This vulnerability affects the following versions and releases of IBM WebSphere Application Server

• Version 8.5.5 Full Profile and Liberty
• Version 8.5 Full Profile and Liberty
• Version 8.0
• Version 7.0
• Version 6.1

Remediation/Fixes

The recommended solution is to apply the interim fix, Fix Pack or PTF containing APAR PI56811 for each named product as soon as practical. **

For WebSphere Application Server:** **
For V8.5.0.0 through 8.5.5.9 Liberty:**
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI56811
--OR–
· Apply Liberty Fix Pack 16.0.0.2 or later.
**
For V8.5.0.0 through 8.5.5.9 Full Profile:**
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI56811

--OR–
· Apply Fix Pack 8.5.5.10 or later.

For V8.0.0.0 through 8.0.0.12:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI56811

--OR–
· Apply Fix Pack 8.0.0.13 or later. **

For V7.0.0.0 through 7.0.0.41:**
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI56811

--OR–
· Apply Fix Pack 7.0.0.43 or later.

**
For V6.1.0.0 through 6.1.0.47:**
· Upgrade to 6.1.0.47 then apply Interim Fix PI56811

Workarounds and Mitigations

none