Lucene search

K
ibmIBM4A06B161C20E461A58FD910D4170D3E247E39F42D22748E77652F8DE561F969A
HistoryJun 18, 2018 - 1:35 a.m.

Security Bulletin: IBM Flex System Manager (FSM) is affected by a IBM Websphere Application Server (WAS) vulnerability (CVE-2016-8919)

2018-06-1801:35:34
www.ibm.com
2

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

Summary

A vulnerability has been identified in the IBM Websphere Application Server (WAS) that is embedded in IBM FSM. This update addresses this issue.

Vulnerability Details

CVEID: CVE-2016-8919**
DESCRIPTION:** IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118529 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Flex System Manager 1.3.4.0
Flex System Manager 1.3.3.0
Flex System Manager 1.3.2.1
Flex System Manager 1.3.2.0

Remediation/Fixes

IBM recommends updating the FSM using the instructions referenced in this table.

Product |

VRMF |

Remediation
—|—|—

Flex System Manager |

1.3.4.0 |

Install fsmfix1.3.4.0_IT19246

Flex System Manager |

1.3.3.0 |

Install fsmfix1.3.3.0_IT19246

Flex System Manager |

1.3.2.1
1.3.2.0 |

Install fsmfix1.3.2.0_IT19246

For all VRMF not listed in this table, IBM recommends upgrading to a fixed and supported version/release of the product.

For a complete list of FSM security bulletins refer to this technote: http://www-01.ibm.com/support/docview.wss?uid=nas7797054ebc3d9857486258027006ce4a0&myns=purflex&mync=E&cm_sp=purflex--NULL--E

Workarounds and Mitigations

None

CPENameOperatorVersion
flex system manager nodeeqany

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

Related for 4A06B161C20E461A58FD910D4170D3E247E39F42D22748E77652F8DE561F969A