Security Bulletin: Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Network Manager IP Edition

Summary

Websphere Application Server (WAS) is shipped as a component IBM Tivoli Network Manager IP Edition. Information about a security vulnerability affecting WAS has been published in a security bulletin.

Vulnerability Details

Please consult following security bulletins in WebSphere Application Server for vulnerability details and information about fixes.

• Potential cross-site scripting in the Admin Console for WebSphere Application Serve (CVE-2016-8934)
• Potential Information Disclosure vulnerability in WebSphere Application Server (CVE-2016-5986)
• There is a potential information disclosure in WebSphere Application Server using malformed SOAP requests on WebSphere Application Server.
• Certificates will need to be converted to use SHA256withRSA in WebSphere Application Server
• Multiple vulnerabilities in IBM® Java SDK affects WebSphere Application Server October 2016 CPU (CVE-2016-5573, CVE-2016-5597)
• Multiple vulnerabilities in IBM® Java SDK affects WebSphere Application Server July 2016 CPU (CVE-2016-3485)
• Redirect HTTP traffic vulnerability may affect IBM HTTP Server (CVE-2016-5387)
• Apache Commons FileUpload Vulnerability affects WebSphere Application Server (CVE-2016-3092)
• Vulnerabilities in Apache Struts affects IBM WebSphere Application Server
• Potential denial of service with SIP Services (CVE-2016-2960)
• Bypass security restrictions in WebSphere Application Server (CVE-2016-0385)
• HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359)
• Potential security vulnerability in IBM WebSphere Application Server if FIPS 140-2 is enabled
• Multiple Denial of Service vulnerabilities with Expat may affect IBM HTTP Server

======================================

Affected Products and Versions

Affected Product and Version(s)

| Product and Version shipped as a component
—|—
IBM Tivoli Network Manager 3.9| Bundled the TIP version 2.1.0.x which bundled IBM WebSphere version 7.0.0.x.
IBM Tivoli Network Manager 4.1| Bundled the TIP version 2.2.0.x which bundled IBM WebSphere version 7.0.0.x…
IBM Tivoli Network Manager 4.1.1| Bundled the TIP version 2.2.0.x which bundled IBM WebSphere version 7.0.0.x.
IBM Tivoli Network Manager 4.2| IBM Tivoli Network Manager 4.2 requires to install IBM Websphere Application Server Version 8.5.5.5 or later version separately. Users are recommended to apply IBM WebSphere version 8.5.5.5 Security Interim Fixes…