Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for IBM Tivoli Network Manager IP Edition April 2014 CPU

Summary

Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM Tivoli Network Manager IP Edition

Vulnerability Details

Tivoli Network Manager is shipped with an IBM SDK Java Technology Edition that is based on the Oracle JDK. Oracle has released April 2014 critical patch updates (CPU) which contain security vulnerability fixes. The IBM SDK for Java has been updated to incorporate these fixes plus one additional vulnerability (CVE-2014-0878) .
CVEID: CVE-2014-0878 **
DESCRIPTION:** A vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic providers potentially allows an attacker to predict the output of the random number generator under certain circumstances. Please refer to the Workarounds & Mitigation section below for additional information.
CVSS Base Score: 5.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/91084&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)
**
CVEID:** CVE-2014-0460**
DESCRIPTION:** An unspecified vulnerability related to the JNDI component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 5.8
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/92482&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVEID: CVE-2014-0453**
DESCRIPTION:** An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/92490&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

Affected Products and Versions

Affected Product and Version(s)

| Product and Version shipped as a component
—|—
Tivoli Network Manager 3.8| Bundled the TIP version 1.1.1.x, IBM WebSphere version 6.1.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 6.
Tivoli Network Manager 3.9| Bundled the TIP version 2.1.0.x, IBM WebSphere version 7.0.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 7.
Tivoli Network Manager 4.1| Bundled the TIP version 2.2.0.x, IBM WebSphere version 7.0.0.x and the JRE from IBM SDK Java 2 Technology Edition Version 7.

Remediation/Fixes

Upgrade your SDK to an interim fix level as determined below: _
_http://www-01.ibm.com/support/docview.wss?uid=swg21673013_
_
Download and apply the interim fix APARs below, for your appropriate release:

For Tivoli Network Manger IP Edition 3.9 and 4.1 version, WebSphere V7.0.0.0 through 7.0.0.31:

• Apply Interim Fix PI14305: Will upgrade you to SDK 6 SR16
  --OR–

• Apply IBM SDK for Java shipped with WebSphere Application Server Fix pack 33 (7.0.0.33) or later (targeted to be available 23 June 2014).
  **
  For Tivoli Network Manger IP Edition 3.8 version, WebSphere For V6.1.0.0 through 6.1.0.47:**

• Refer to_ October 2015 CPU_ and apply fix