WebSphere Application Server that is shipped and used by Tivoli Storage Productivity Center could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.
CVEID: CVE-2015-1920**
DESCRIPTION:** WebSphere Application Server could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.
CVSS Base Score: 9.3
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/102404>_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Tivoli Storage Productivity Center 5.2.0 through 5.2.6
Tivoli Storage Productivity Center 5.1.0 through 5.1.1.7
Tivoli Storage Productivity Center 4.2.0 through 4.2.2.195
Tivoli Storage Productivity Center 4.1.x
TotalStorage Productivity Center 3.3.x
The versions listed above apply to all licensed offerings of Tivoli Storage Productivity Center, including IBM SmartCloud Virtual Storage Center Storage Analytics Engine.
System Storage Productivity Center is affected if it has one of the Tivoli Storage Productivity Center versions listed above installed on it
The solution is to apply an appropriate Tivoli Storage Productivity Center fix maintenance for each named product and execute the manual steps listed below. The solution should be implemented as soon as practicable.
**
Note:** It is always recommended to have a current backup before applying any update procedure.
Tivoli Storage Productivity Center V5
Apply the Tivoli Storage Productivity Center fix maintenance as soon as practicable. (See Latest Downloads.)
Affected TPC Version | APAR | Fixed TPC Version | Availability |
---|---|---|---|
5.2.x | IT11016 | 5.2.7 | August 2015 |
5.1.x | IT11016 | 5.1.1.8 |
Manual update steps are required in addition to applying 5.1.1.8 and are listed below this table.| July 2015
Tivoli Storage Productivity Center 5.1.1.8 includes:
Additional step for Tivoli Storage Productivity Center 5.1.1.8:
Apply WebSphere Application Server 7.0 interim fix PI38302 to Tivoli Integrated Portal. See the WebSphere Application Server security bulletin for more info.
Tivoli Storage Productivity Center V4
Apply the Tivoli Storage Productivity Center fix pack as soon as practicable (See Latest Downloads.) and follow the manual steps provided.
Affected TPC Version | APAR | Fixed TPC Version | Availability |
---|---|---|---|
4.2.x | IT11017 | 4.2.2 FP10 | |
(4.2.2.199) |
Manual update steps are required in addition to applying 4.2.2 FP10 and are listed below this table.| August 2015
Tivoli Storage Productivity Center 4.2.2 FP10 includes:
Additional steps for Tivoli Storage Productivity Center 4.2.x:
None
Subscribe to [My Notifications](< http://www-01.ibm.com/software/support/einfo.html>) to be notified of important product support alerts like this.
Complete CVSS v2 Guide
On-line Calculator v2
Off
IBM Security Alerts _
_Security Bulletin: Security Vulnerability in IBM Java SDK affect WebSphere Application Server (CVE-2015-1920)
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
None
31 August 2015: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
[{โProductโ:{โcodeโ:โSS5R93โ,โlabelโ:โIBM Spectrum Controlโ},โBusiness Unitโ:{โcodeโ:โBU058โ,โlabelโ:โIBM Infrastructure w/TPSโ},โComponentโ:โโโ,โPlatformโ:[{โcodeโ:โPF002โ,โlabelโ:โAIXโ},{โcodeโ:โPF010โ,โlabelโ:โHP-UXโ},{โcodeโ:โPF016โ,โlabelโ:โLinuxโ},{โcodeโ:โPF027โ,โlabelโ:โSolarisโ},{โcodeโ:โPF033โ,โlabelโ:โWindowsโ},{โcodeโ:โPF035โ,โlabelโ:โz/OSโ}],โVersionโ:โ5.1;5.1.1;5.2;5.2.1;5.2.2;5.2.3;5.2.4;5.2.5;5.2.6โ,โEditionโ:โโ,โLine of Businessโ:{โcodeโ:โLOB26โ,โlabelโ:โStorageโ}},{โProductโ:{โcodeโ:โSS5R93โ,โlabelโ:โIBM Spectrum Controlโ},โBusiness Unitโ:{โcodeโ:โBU058โ,โlabelโ:โIBM Infrastructure w/TPSโ},โComponentโ:" โ,โPlatformโ:[{โcodeโ:โPF002โ,โlabelโ:โAIXโ},{โcodeโ:โPF010โ,โlabelโ:โHP-UXโ},{โcodeโ:โPF016โ,โlabelโ:โLinuxโ},{โcodeโ:โPF027โ,โlabelโ:โSolarisโ},{โcodeโ:โPF033โ,โlabelโ:โWindowsโ},{โcodeโ:โPF035โ,โlabelโ:โz/OSโ}],โVersionโ:โ4.2;4.2.1;4.2.2โ,โEditionโ:โ",โLine of Businessโ:{โcodeโ:โLOB26โ,โlabelโ:โStorageโ}}]