IBM9C14329016F5418723129DEF900843F6DADE916AF1558462C16C6E034CB381D5Security Bulletin: A security vulnerability has been idenfied in IBM SDK which affects DataQuant for z/OS ( CVE-2019-2684, CVE-2019-2602, CVE-2019-2697, CVE-2019-2698)
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Summary
A security vulnerability has been identified in IBM SDK that could affect DataQuant for z/OS.
Vulnerability Details
CVEID: CVE-2019-2684
CVSS Base Score: 5.9
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded RMI component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
CVEID: CVE-2019-2602
CVSS Base Score: 7.5
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a high availability impact using unknown attack vectors.
CVEID: CVE-2019-2697
CVSS Base Score: 8.1
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE 2D component could allow an unauthenticated attacker to take control of the system.
CVEID: CVE-2019-2698
CVSS Base Score: 8.1
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE 2D component could allow an unauthenticated attacker to take control of the system.
Affected Products and Versions
Principal Products and Versions
DataQuant for z/OS 2.1
Remediation/Fixes
Steps to update JRE - DataQuant:
- Close DataQuant.
- Download JRE (ibm-java-jre-80-win-i386) and extract the files to a temporary location.
- Replace jre folder at the install directory location –> “C:\Program Files (x86)\IBM\IBM DataQuant\DataQuant for Workstation”. Replace with contents in step # 2.
- Download eclipse oxygen from https://www.eclipse.org/downloads/download.php?file=/technology/epp/downloads/release/oxygen/3a/eclipse-jee-oxygen-3a-win32-x86_64.zip
- Extract the eclipse oxygen and copy the plugin - org.apache.jasper.glassfish_2.2.2.v201501141630.jar from eclipse-jee-oxygen-3a-win32-x86_64\eclipse\plugins
- Copy org.apache.jasper.glassfish_2.2.2.v201501141630.jar in the folder where DataQuant is installed - C:\Program Files (x86)\IBM\IBM DataQuant\DataQuant for Workstation\plugins
- Delete the older plugin org.apache.jasper.glassfish_2.2.2.v201205150955.jar from the DataQuant install directory
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm dataquant for z/os | eq | 2.1 |
Related
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P