IBM450B93723585F308484F35566FF171937C1CA99A7F7004CD4BE6B5C9899F86E3Security Bulletin: A vulnerability in the Apache Xerces-C XML parser affects IBM Security Access Manager for Web (CVE-2016-0729)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
Summary
IBM Security Access Manager for Web is affected by a vulnerability in the Apache Xerces-C XML parser.
Vulnerability Details
CVEID: CVE-2016-0729**
DESCRIPTION:** Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during processing and error reporting. By sending specially crafted input documents, an attacker could exploit this vulnerability to cause the library to crash or possibly execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111028 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
IBM Security Access Manager for Web 7.0 appliances
IBM Security Access Manager for Web 8.0, all firmware versions
IBM Security Access Manager 9.0, all firmware versions
Remediation/Fixes
IBM has provided patches for all affected versions. Follow the installation instructions in the README files included with the patch.
| Product | VRMF | APAR | Remediation |
|---|---|---|---|
| IBM Security Access Manager for Web | 7.0 (appliance) | IV87152 | Apply Interim Fix 26: |
| 7.0.0-ISS-WGA-IF0026 | |||
| IBM Security Access Manager for Web | 8.0.0.0 - | ||
| 8.0.1.4 | IV87118 | 1. For versions prior to 8.0.1.4, upgrade to 8.0.1.4: | |
| 8.0.1-ISS-WGA-FP0004 | |||
| 2. Apply 8.0.1.4 Interim Fix 2: | |||
| 8.0.1.4-ISS-WGA-IF0002 | |||
| IBM Security Access Manager | 9.0 | IV87078 | 1. For versions prior to 9.0.1.0, upgrade to 9.0.1.0: |
| IBM Security Access Manager V9.0.1 Multiplatform, Multilingual (CRW4EML) | |||
| 2. Apply 9.0.1.0 Interim Fix 4: | |||
| 9.0.1.0-ISS-ISAM-IF0004 |
Workarounds and Mitigations
None.
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P