Lucene search

K
ibmIBM773DDD02D33CA887669E403873832C97214FE7479EC22378C819CABAB56A0F98
HistoryAug 02, 2019 - 7:42 a.m.

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2018 - Includes Oracle Jul 2018 CPU affects DB2 Recovery Expert for Linux, Unix and Windows

2019-08-0207:42:29
www.ibm.com
3

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6, Version 7 ,version 8, that is used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in July 2018.

Vulnerability Details

CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private keys. An attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/111140&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x86_64 Montgomery squaring function bn_sqrx8x_internal(). An attacker with online access to an unpatched system could exploit this vulnerability to obtain information about the private key.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/134397&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-3732 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagating bug in the x86_64 Montgomery squaring procedure. An attacker could exploit this vulnerability to obtain information about the private key.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/121313&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2018-2952
**DESCRIPTION:*An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Concurrency component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/146815&gt; for the current score
CVSS Environmental Score
: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2018-1656
**DESCRIPTION:*The IBM Java Runtime Environment’s Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.
CVSS Base Score: 7.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/144882&gt; for the current score
CVSS Environmental Score
: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the failure to restrict the use of Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations to only the process owner. An attacker could exploit this vulnerability to execute untrusted native code and gain elevated privileges on the system.
CVSS Base Score: 8.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148389&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

DB2 Recovery Expert for LUW 5.1
DB2 Recovery Expert for LUW 5.1 Interim Fix 1 (IF1)
DB2 Recovery Expert for LUW 5.1.0.1 (also called 5.1 Fix Pack 1)
DB2 Recovery Expert for LUW 5.1.0.1 IF1
DB2 Recovery Expert for LUW 5.1.0.1 IF2
DB2 Recovery Expert for LUW 5.1.0.2 (also called 5.1 Fix Pack 2)
DB2 Recovery Expert for LUW 5.1.0.2 IF1

Remediation/Fixes

Product VRMF Remediation/First Fix
DB2 Recovery Expert for Linux, Unix and Windows had been fixed in V5.1.0.3 https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/DB2+Recovery+Expert+for+Linux+UNIX+and+Windows&release=All&platform=All&function=all

Workarounds and Mitigations

There are no workarounds except to replace to the latest JRE.
To solve the problem without updating the entire Recovery Expert product, the user can replace the existing JRE that is installed into the product installation tree in the “jre” directory with a newer JRE that includes the security fixes.

Instructions to replace the IBM JRE for DB2 Recovery Expert for Linux, UNIX and Windows

1. Identify the version and platform of your DB2 Recovery Expert installation.
2. See the table below to find the IBM JRE download link that matches your product version and platform. If you cannot find a JRE download link for your product version and platform, contact IBM Technical Support and refer to this tech-note
3. Download the zip file (for example: ibm-java-jre-x.x-x.x-linux-x86_64.tgz) and extract it to a folder on a local file system (for example: /tmp/ibm-jre-x.x-x.x).
4. Stop the DB2 Recovery Expert server using the stop.sh command (for example: /opt/ibm/RE/stop.sh).
5. Back-up and then delete the contents of the “jre” folder from your product installation directory (for example: /opt/ibm/RE/jre).
6. Copy the contents of the “jre” folder from the latest IBM JRE that you downloaded in Step 3 (for example: /tmp/ibm-jre-x.x-x.x/jre/) to the “jre” folder in your product installation directory (for example: /opt/ibm/RE/jre/).*
7. Ensure that the file permissions for the new JRE files and folders match the file permissions for the original JRE files and folders. If necessary, set 775 recursively.
8. Restart the DB2 Recovery Expert server using the start.sh command (for example: /opt/ibm/RE/start.sh).

  • NOTE: You must repeat from Step 6 again any time you install an APAR or upgrade to an affected version of DB2 Recovery Expert.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

Related for 773DDD02D33CA887669E403873832C97214FE7479EC22378C819CABAB56A0F98