Security Bulletin: A security vulnerability has been identified in Oracle MySQL, which is a supported topology database of IBM Tivoli Network Manager IP Edition (CVE-2018-2755).

Summary

Oracle MySQL version 5.5.x and version 5.6.x is a supported topology database of IBM Tivoli Network Manager IP Edition 3.9 Fix Pack 4 and Fix Pack 5. Information about a security vulnerability affecting Oracle MySQL has been published here.

Vulnerability Details

CVEID: CVE-2018-2755**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL related to the Server Replication component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 7.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141913 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

Affected Products and Versions

ITNM 3.9.0.4 and ITNM 3.9.0.5 deployments which use Oracle MySQL v5.5 or v5.6 as their topology database server.

Remediation/Fixes

Product

| VMRF|Remediation/First Fix
—|—|—
IBM Tivoli Network Manager IP Edition|** 3.9.0.4 and 3.9.0.5**| Upgrade Oracle MySQL v5.5/5.6 servers as advised in Oracle’s Critical Patch Update for April 2018.

Please also note the****end of support announcement** from 12 September 2017 for selected Netcool product versions. You can find detailed information on whether the product version you have installed in your environment is affected by this end of service announcement by following the**Netcool End of Support Knowledge Collection**.**If your product version is affected, IBM recommend to upgrade your product version to the latest supported version of your product. Please contact your IBM account manager for any question you might have or for any assistance you may require for upgrading an end of service announced offering.