Security Bulletin: Critical Security Vulnerability in Rational Directory Server (Tivoli and Apache) (CVE-2014-3089)

Summary

A security vulnerability impacts IBM Rational Directory Server (RDS) 5.2.x, 5.1.1.x and Rational Directory Administrator (RDA) 6.x Java Client library.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVEID: CVE-2014-3089

Description: The RDS Java Client library carries clear text password ofroot user. A potential hacker with this password information could connect to RDS and could exploit its consuming products data.

CVSS Base Score: 2.1 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94255&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Product

| Version
—|—
Rational Directory Server (Tivoli) | 5.2 - 5.2.1_iFix002
Rational Directory Server (Apache)| 5.1.1 - 5.1.1.2_iFix003
Rational Directory Administrator| 6.0 and 6.0.0.1

Remediation/Fixes

Apply the following fix for your release of RDS.

Important Notes:

• If RDS (Tivoli/Apache) is patched with the fix above, it is mandatory for Rational Synergy to be patched with a fix, else the communication between RDS and Synergy will break. Review Security Bulletin: Critical Security Vulnerability in RDS Client library affecting Rational Synergy (CVE-2014-3089) for details.
• If RDS (Tivoli/Apache) is patched with the fix above, it is recommended (but not mandatory) for Rational Change to be patched with a fix. Review Security Bulletin: Critical Security Vulnerability in RDS Client library affecting Rational Change (CVE-2014-3089) for details.
• The above vulnerability in RDS does not affects Rational DOORS.

Workarounds and Mitigations

None