Security Bulletin: Multiple vulnerabilities in IBM Rational Build Forge (CVE-2012-3213, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, C

Summary

IBM Rational Build Forge is shipped with an IBM Java that is based on Oracle Java. Oracle has released critical patch updates (CPUs) January 13, February 1 and February 19 that contain security vulnerability fixes and IBM Java is affected. These fixes have been added to the Rational Build Forge 8.0 release.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID: CVE-2012-3213

Description:

An unspecified vulnerability in Oracle Java within the Scripting component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81769&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0419

Description:

An unspecified vulnerability in Oracle Java within the Deployment component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 7.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81783&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0423

Description:

An unspecified vulnerability in Oracle Java within the Deployment component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 7.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81784&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0424

Description:
An unspecified vulnerability in Oracle Java within the RMI component could allow a remote attacker to manipulate certain data.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81798&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE ID: CVE-2013-0425

Description:

An unspecified vulnerability in Oracle Java Runtime Environment related to Libraries has no confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81766&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0426

Description:

An unspecified vulnerability in Oracle Java within the Libraries component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81767&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0427

Description:

An unspecified vulnerability in Oracle Java within the Libraries component could allow a remote attacker to manipulate certain data.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81795&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE ID: CVE-2013-0428

Description:

An unspecified vulnerability in Oracle Java within the Libraries component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81768&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0433

Description:

An unspecified vulnerability in Oracle Java within the Networking component could allow a remote attacker to manipulate certain data.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81797&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE ID: CVE-2013-0434

Description:

An unspecified vulnerability in Oracle Java within the JAXP component could allow a remote attacker to obtain sensitive information.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81792&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE ID: CVE-2013-0435

Description:

An unspecified vulnerability in Oracle Java within the JAX-WS component could allow a remote attacker to obtain sensitive information.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81791&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE ID: CVE-2013-0437

Description:

An unspecified vulnerability in Oracle Java within the Java Runtime Environment 2D component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81753&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0443

Description:
An unspecified vulnerability in Oracle Java within the JSSE component could allow a remote attacker to obtain sensitive information and manipulate certain data.

CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81801&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVE ID: CVE-2013-1478

Description:

An unspecified vulnerability in Oracle Java within the Java Runtime Environment 2D component could allow a remote attacker to execute arbitrary code on the system with elevated privileges.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81754&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-1493

Description:
Oracle Java Runtime Environment could allow a remote attacker to execute arbitrary code on the system, caused by an error in the color management (CMM) functionality within the 2D component. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability using an image with crafted raster parameters to execute arbitrary code on the system.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/82514&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID: CVE-2013-0440

Description:

An unspecified vulnerability in Oracle Java within the JSSE component could allow a remote attacker to cause a denial of service.

CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81799&gt;
CVSS Environment Score: Undefined
CVSS Access Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM Rational Build Forge versions before 8.0 on all supported operating systems.

Remediation/Fixes

Upgrade to Rational Build Forge 8.0, which contains the updated IBM Java.

Workarounds and Mitigations

None. If you are unable to upgrade to version 8.0, contact IBM Technical Support.