Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.39

Summary

Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server, IBM WebSphere Application Server Hypervisor, WebSphere Application Server Liberty Profile and IBM HTTP Server.

Vulnerability Details

CVE ID:CVE-2015-1885**
DESCRIPTION: WebSphere Application Server Full Profile and Liberty Profile could allow a remote attacker to gain elevated privileges on the system when OAuth grant type of password is used.

CVSS:** _
CVSS Base Score: 9.3
CVSS Temporal Score: See _https://exchange.xforce.ibmcloud.com/vulnerabilities/101255 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:C/I:C/A:C) **

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

• Version 8.5 Full Profile and Liberty Profile
• Version 8.0
• Version 7.0

**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._

Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI36211 for Full Profile and PI33202 for Liberty Profile, as noted below: **

For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition
For V8.5.0.0 through 8.5.5.5 Full Profile: **

• Upgrade to minimal fix pack levels required by interim fix and then apply Interim Fix PI36211

-- OR

• Apply Fix Pack 6 (8.5.5.6), or later.
• After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

**

For V8.5.0.0 through 8.5.5.4 Liberty Profile:**

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI33202_ _

-- OR

• Apply Fix Pack 5 (8.5.5.5), or later.

**
For V8.0.0.0 through 8.0.0.10:**

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI36211

-- OR

• Apply Fix Pack 11 (8.0.0.11), or later.
• After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

**
For V7.0.0.0 through 7.0.0.37:**

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI36211

-- OR

• Apply Fix Pack 39 (7.0.0.39), or later.
• After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

_
Workaround(s):None known
Mitigation(s):_None known **
CVEID:CVE-2015-0250
DESCRIPTION:** Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted SVG file, an attacker could exploit this vulnerability to reveal files and obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101614 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
**
AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

• Version 8.5 Full Profile
• Version 8
• Version 7
• Version 6.1

**
Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix Pack or PTF for each named product as soon as practical._

Fix:_**
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI39768 or PI49437, as noted below: (PI49437 is a replace interim fix for PI39768 for version 7 and version 6.1).
**
For IBM WebSphere Application Server Full profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5:**

• Apply Fix Pack 6 (8.5.5.6), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI39768

**
For V8.0.0.0 through 8.0.0.10:**

• Apply Fix Pack 11 (8.0.0.11), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI39768

**
For V7.0.0.0 through 7.0.0.37:**

• Apply Fix Pack 39 (7.0.0.39), or later containing APAR PI39768.

-- OR

• Apply Interim Fix PI49437

**_
_**For V6.1.0.0 through 6.1.0.47:

• Apply Fix Pack 47 (6.1.0.47), and then apply Interim Fix PI49437

_
Workaround(s):None known
Mitigation(s):_ None known

**
CVEID:CVE-2015-1927
DESCRIPTION:** IBM WebSphere Application Server could allow a remote attacker to gain elevated privileges on the system, caused by an application not having the correct serveServletsbyClassname setting. By a developer not setting the correct property, an attacker could exploit this vulnerability to gain unauthorized access.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102872 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

**
AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

• Version 8.5 Full Profile and Liberty Profile
• Version 8
• Version 7

**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._

Fix:**
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI31622, as noted below:
**
Please Note:_**This APAR has changed the default value of the WebContainer custom property com.ibm.ws.webcontainer.disallowServeServletsByClassname from false to true so that no security threat could occur. Prior to this change, it was up to the developer to remember to change the custom property to true before deploying into production.

**
Property Name: _com.ibm.ws.webcontainer.disallowServeServletsByClassname _
Description: If set to true, disallows the use of serveServletsByClassnameEnabled at the application server level, overriding any setting of serveServletsByClassnameEnabled at the application level. This property affects all applications.
Values: **true(default)/false

If you need to change the value please refer to the the following technote for instructions on enabling WebContainer custom properties:

Full Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21284395
Liberty Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21597753 **

For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5:**

• Apply Fix Pack 6 (8.5.5.6), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI31622

**
For V8.0.0.0 through 8.0.0.10:**

• Apply Fix Pack 11 (8.0.0.11), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI31622

**
For V7.0.0.0 through 7.0.0.37:**

• Apply Fix Pack 39 (7.0.0.39), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI31622

**_
_**For V6.1.0.0 through 6.1.0.47:

• Upgrade to Fix Pack 47 (6.1.0.47) and apply Interim Fix PI31622

Workaround(s): Set the custom property com.ibm.ws.webcontainer.disallowServeServletsByClassName to true**_
Mitigation(s):_None known **
** CVEID: CVE-2015-1932
DESCRIPTION:** IBM WebSphere Application Server and IBM WebSphere Virtual Enterprise could allow a remote attacker to obtain information that identifies the proxy server software being used.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102970 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

• Version 8.5 Full Profile
• Version 8
• Version 7
• Version 7 IBM WebSphere Virtual Enterprise on WebSphere Application Server Version 7 and Version 8

**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._

Fix:_**
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI38403, as noted below:

_Note: _
By default, the ODR and proxy server will ignore the http.compliance.via custom property and not set the HTTP Via header. A new custom property is being introduced that if set to false will allow the http.compliance.via setting to be honored. The custom property, http.ignore.compliance.via can be set on an ODR or Proxy server.

In the Administrative console, expand Servers>Server Types > On Demand Routers > server_name to open the configuration tab for the server.
Expand On Demand Router settings, click On Demand Router Properties
Under Additional properties, click Custom properties > new.

**_
_****For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Hypervisor Edition and IBM WebSphere Virtual Enterprise

For V8.5.0.0 through 8.5.5.6:**

• Apply Fix Pack 7 (8.5.5.7) or later.

-- OR

• Apply the mitigation below

**
For V8.0.0.0 through 8.0.0.10:**

• Apply Fix Pack 11 (8.0.0.11), or later.

-- OR

• Apply the mitigation below

**
For V7.0.0.0 through 7.0.0.37:**

• Apply Fix Pack 39 (7.0.0.39), or later.

-- OR

• Apply the mitigation below

For IBM WebSphere Virtual Enterprise using WebSphere Application Server V7.0 and V8.0:

• Apply WebSphere Virtual Enterprise Fix Pack 7 (7.0.0.7) or later (targeted to be available 1Q 2016).

-- OR

• Apply the mitigation below

_
Workaround(s):**None known **
Mitigation(s):_ Remove the custom property _http.compliance.via _or set it to false.
To remove the custom property _http.compliance.via: _

In the Administrative console, expand Servers>Server Types > On Demand Routers > server_name to open the configuration tab for the server.
Expand On Demand Router Properties, click On Demand Router Settings
Under Additional properties, click Custom properties, select the check box next to http.compliance.via property and press the Delete button.

Alternatively, to set the property to false, click on http.compliance.via and change the value of the property to false and press the OK button.

CVEID: CVE-2015-4938**
DESCRIPTION:** IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this vulnerability to persuade the user into entering sensitive information.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104415 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

• Version 8.5 Full Profile and Liberty Profile
• Version 8
• Version 7

**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._

Fix:**
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI37396, as noted below:
**
_****For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.6:**

• Apply Fix Pack 7 (8.5.5.7), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI37396

**
For V8.0.0.0 through 8.0.0.10:**

• Apply Fix Pack 11 (8.0.0.11), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI37396

**
For V7.0.0.0 through 7.0.0.37:**

• Apply Fix Pack 39 (7.0.0.39), or later.

-- OR

• Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI37396

_
Workaround(s):None known
Mitigation(s):_ None known

Other APARs shipped with 7.0.0.39 are included in the security bulletins below:
PI39833 Security bulletin: IBM HTTP Server Windows Denial of Service
PI36563 Security Bulletin: RSA Export Keys for WebSphere Application Server
PI36563/PI35289 _Security Bulletin: RC4 Stream Cipher for WebSphere Application Server _
PI38302 _Security Bulletin: Management Port for WebSphere Application Server _
PI36417 Security Bulletin: RSA Export Keys for IBM HTTP Server
PI34229 Security Bulletin: RC4 Stream Cipher for IBM HTTP Server
PI42928 Security Bulletin: HTTP Request Smuggling for IBM HTTP Server
PI44793 Security Bulletin: Stack Buffer overflow for IBM HTTP Server
PI45266 Security Bulletin: HTTP Response splitting attack in WebSphere Application Server
PI45596 Security Bulletin: Denial of Service for IBM HTTP Server