Security Bulletin: Information disclosure in Apache Commons HttpClient used by WebSphere Application Server (CVE-2012-5783)

Summary

There is a potential information disclosure in Apache Commons HttpClient used by WebSphere Application Server.

Vulnerability Details

CVEID: CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject’s Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79984 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

This vulnerability affects the following versions and releases of IBM WebSphere Application Server traditional:

• Version 9.0
• Version 8.5
• Version 8.0
• Version 7.0

Remediation/Fixes

The recommended solution is to apply the interim fix, Fix Pack or PTF containing the APARs for each named product as soon as practical. There are 2 separate interim fixes that may need to be applied, links are provided below:
APARs
PI96685 - for users of JAX-WS Web Services
PI98251 - for users of SOAP Connector (default)

For WebSphere Application Server traditional and WebSphere Application Server Hypervisor Edition:

For V9.0.0.0 through 9.0.0.7:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI96685 and PI98251
--OR–
· Apply Fix Pack 9.0.0.8 or later.

For V8.5.0.0 through 8.5.5.13:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI96685 and PI98251
--OR–
· Apply Fix Pack 8.5.5.14 or later.

For V8.0.0.0 through 8.0.0.15:
· Upgrade to a minimal fix pack level as required by interim fixes and then apply Interim Fix PI96685 and PI98251

For V7.0.0.0 through 7.0.0.45:
· Upgrade to a minimal fix pack levels as required by interim fixes and then apply Interim Fix PI96685 and PI98251

_WebSphere Application Server V7 and V8 are no longer in full support; IBM recommends upgrading to a fixed, supported version/release/platform of the product. _