Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE

Summary

This Security Bulletin addresses the security vulnerabilities that have shipped with the IBM Java Runtime Environment (JRE) included in IBM Operational Decision Manager and IBM ILOG JRules. IBM ODM and ILOG JRules now include the most recent version of the IBM JRE which fixes the security vulnerabilities reported in Oracle’s Critical Patch Update releases of January 2014.

Vulnerability Details

CVE ID

CVE-2014-0423, CVE-2014-0416, CVE-2014-0411

DESCRIPTION

This bulletin also covers all applicable CVEs published by Oracle as part of their January 2014 Java SE Critical Patch Update. For more information please refer to Oracle’s January 2014 Java SE CPU Advisory.

CVEID:CVE-2014-0423

CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/90340&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/S:C/P:I/N:A/P)

The DocumentHandler used by the java.beans.XMLDecoder implementation allows the use of external entities by default. This facilitates a variety of attacks via malicious XML data.
The fix ensures that external entities are ignored by java.beans.XMLDecoder.

CVEID:CVE-2014-0416
CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/90349&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/P:A/N)

javax.security.auth.Subject is serializable but does not validate deserialized data properly. Malicious code could exploit this to construct an invalid Subject instance with content that differs from the advertised properties. In addition, if a server deserializes serialized data from untrusted sources, an attacker could insert an invalid instance of Subject class into a server Java process.
The fix ensures that serialized instances of Subject are deserialized correctly and safely.

CVEID:CVE-2014-0411
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/90357&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/H:Au/N:C/P:I/P:A/N)

Timing differences based on the validity of messages can be exploited to decrypt the entire session. The exploit is not trivial, requiring a man-in-the-middle position and a long time (around 20 hours).
The fix eliminates the timing differences.

Affected Products and Versions

IBM WebSphere ILOG JRules v7.1,

IBM WebSphere Operational Decision Management v7.5

IBM Operational Decision Manager v8.0

IBM Operational Decision Manager v8.5

Remediation/Fixes

For IBM WebSphere ILOG JRules V7.1 an interim fix for APAR RS01542 is available from IBM Fix Central: 7.1.1.5-WS-BRMS_JDK-WIN-IF036.

For IBM Operational Decision Manager interim fixes for APAR RS01542 are available on Fix Central:

• v7.5 Interim Fix 36: 7.5.0.4-WS-ODM_JDK-<OS>-IF036
• v8.0 Fix Pack 2 : 8.0.1-WS-ODM-<OS>-FP002
• v8.5 Interim Fix 17: 8.5.0.0-WS-ODM_JDK-<OS>-IF022

If you are using WebSphere ILOG JRules V7.0 we recommend upgrading to the latest version before End of Service in 2014. In case you need this update you can install the interim fix provided for JRules V7.1 to refresh the IBM JRE.