Security Bulletin: Multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 affect IBM Flex System Manager (FSM) SMIA Configuration Tool.

Summary

There are multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 that is used by IBM Flex System Manager (FSM) SMIA Configuration Tool. These issues were disclosed as part of the Oracle updates in October 2014 and January 2015.

Vulnerability Details

Summary

There are multiple vulnerabilities in Oracle Java SE Runtime Environment, Versions 1.6.0 and 1.7.0 that is used by IBM Flex System Manager (FSM) SMIA Configuration Tool. These issues were disclosed as part of the Oracle updates in October 2014 and January 2015.

Vulnerability Details

CVE-ID: CVE-2015-0410

Description: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.

CVSS Base Score: 5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/100151&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2014-6593

Description: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 4
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/100153&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVE-ID: CVE-2014-3566

Description: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and calculate the plaintext of secure connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97013&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2014-6468

Description: An unspecified vulnerability related to the Hotspot component has complete confidentiality impact, complete integrity impact, and complete availability impact.

CVSS Base Score: 6.9
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97138&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVE-ID: CVE-2014-6517

Description: An unspecified vulnerability in Oracle Java SE and JRockit related to the JAXP component could allow a remote attacker to obtain sensitive information.

CVSS Base Score: 5.0
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97145&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2014-6512

Description: Oracle Java SE and JRockit could allow a remote attacker to bypass security restrictions, caused by the failure to perform source address checks for packets received on a connected socket by the DatagramSocket implementation in OpenJDK. An attacker could exploit this vulnerability to process packets as if they were received from the expected source.

CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97147&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2014-6457

Description: An unspecified vulnerability in Oracle Java SE and JRockit related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 4.0
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97148&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVE-ID: CVE-2014-6558

Description: An unspecified vulnerability related to the Security component has no confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 2.6
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97151&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

Affected products and versions

• Flex System Manager 1.1.x.x
• Flex System Manager 1.2.0.x
• Flex System Manager 1.2.1.x
• Flex System Manager 1.3.0.x
• Flex System Manager 1.3.1.x
• Flex System Manager 1.3.2.x

Remediation/Fixes

IBM recommends updating the Flex System Manager (FSM) SMIA using the instructions referenced in the table below.

You should verify applying this configuration change does not cause any compatibility issues.

Workarounds and Mitigations

None.

Reference

• Complete CVSS Guide
• On-line Calculator V2
• IBM Java SDK Security Bulletin — Jan 2015
• IBM Java SDK Security Bulletin — Oct 2014

Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None.

Change History
05 May 2015: Original Copy Published
29 July 2015: Updated APAR and SMIA Remediation locations

• The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.