Security Bulletin: Vulnerability in IBM Java SDK affects IMS™ Enterprise Suite: Explorer for Development (CVE-2019-2426)

Summary

There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.25 and earlier that is used by IMS™ Enterprise Suite: Explorer for Development. This issue was disclosed as part of the IBM Java SDK updates in January 2019.

Vulnerability Details

CVE-2019-2426 (CVSS 3.7)

Description

The transparent NTLM authentication implementation in java.net.HttpURLConnection exposes the user’s NTLM credentials to any server that requests them.

The fix disables transparent NTLM authentication by default. A new system property (jdk.http.ntlm.transparentAuth) allows the user to enable transparent NTLM authentication for all hosts or trusted hosts only.

Product Applicability

This issue applies to products or applications that use java.net.HttpURLConnection or javax.net.ssl.HttpsURLConnection.

Mitigation

The only solution is to upgrade the JRE.

Affected Products and Versions

Explorer for Development of the IMS™ Enterprise Suite Versions 3.3.1 and earlier.

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Download URL

—|—|—|—

IMS Enterprise Suite Explorer for Development V3.3

|

3.3.1.14

|

N/A

|

_https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/_