Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Apache Camel

Summary

Vulnerabilities in Apache Camel such as remote attacker executing arbitrary code, remote attacker obtaining sensitive information may affect IBM Spectrum Control. These vulnerabilities have been addressed.

Vulnerability Details

CVEID:CVE-2014-0002
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in the XSLT component when parsing XML entities. By persuading a victim to open a specially-crafted XML document containing external entity references, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/91573 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID:CVE-2017-12633
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by Java object de-serialisation vulnerability in the camel-hessian component. By using deserialized untrusted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/135094 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2015-0264
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error related to the XPath handling of invalid XML Strings or invalid XML GenericFile objects. An attacker could exploit this vulnerability using an XML External Entity (XXE) declaration to read arbitrary files on the system.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101581 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID:CVE-2015-5344
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data by the camel-xstream component. An attacker could exploit this vulnerability using specially crafted data to execute arbitrary Java code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/110297 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2015-0263
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in the XML converter setup. An attacker could exploit this vulnerability using an SAXSource containing an XML External Entity (XXE) declaration to read arbitrary files on the system.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101580 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID:CVE-2013-4330
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by the improper handling of simple language expressions. An attacker could exploit this vulnerability to execute arbitrary code on the system with elevated privileges.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/87542 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

None