Security Bulletin: IBM InfoSphere Streams update of IBM® SDK Java™ Technology Edition (CVE-2016-0363, CVE-2016-0376)

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 Service Refresh 2 Fix Pack 11 and earlier releases, Version 7R1 Service Refresh 3 Fix Pack 31 and earlier releases, and Version 6 Service Refresh 16 Fix Pack 21 and earlier releases provided with IBM InfoSphere streams. These issues were disclosed as part of the IBM Java SDK updates for April 2016.

IBM InfoSphere Streams is providing an IBM Java SDK update that includes fixes for security vulnerabilities. If you run Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether these vulnerabilities are applicable to your code.

Vulnerability Details

CVEID: CVE-2016-0363
DESCRIPTION: IBM SDK, Java Technology Edition contains a vulnerability in the IBM ORB implementation that may allow untrusted code running under a security manager to elevate its privileges. This vulnerability was originally reported as CVE-2013-3009.
CVSS Base Score: 8.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112016&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-0376
DESCRIPTION: A vulnerability in IBM Java SDK could allow a remote attacker to execute arbitrary code on the system. This vulnerability allows code running under a security manager to escalate its privileges by modifying or removing the security manager. This vulnerability was originally reported as CVE-2013-5456.
CVSS Base Score: 8.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112152&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

• • IBM InfoSphere Streams Version 1.2.1.0
• IBM InfoSphere Streams Version 2.0.0.4 and earlier
• IBM InfoSphere Streams Version 3.0.0.6 and earlier
• IBM InfoSphere Streams Version 3.1.0.8 and earlier
• IBM InfoSphere Streams Version 3.2.1.4 and earlier
• IBM InfoSphere Streams Version 4.0.1.1 and earlier
• IBM Streams Version 4.1.1.0 and earlier

Remediation/Fixes

NOTE: Fix Packs are available on IBM Fix Central.

• Version 4.1.1:
  • Apply 4.1.1 Fix Pack 1 (4.1.1.1) or higher.
• Version 4.0.1:
  • Apply 4.0.1 Fix Pack 2 (4.0.1.2) or higher.
• Version 3.2.1:
  • Apply 3.2.1 Fix Pack 5 (3.2.1.5) or higher.
• Versions 1.2, 2.0, 3.0, and 3.1:
  • For version 1.x, 2.x, 3.x IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.

IMPORTANT NOTE: If JAVA_HOME is set ensure it points to the install location of the upgraded IBM Developer Kit, Java. Applications compiled with JAVA_HOME set to a different location will need to be recompiled after JAVA_HOME has been changed. For more information on compiling with JAVA_HOME set see the Notes section on the page at the following URL: http://www-01.ibm.com/support/knowledgecenter/SSCRJU_4.0.0/com.ibm.streams.install.doc/doc/ibminfospherestreams-install-prerequisites-java-supported-sdks.html?lang=en

Workarounds and Mitigations

None