Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Functional Tester

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 & 7 that is used by IBM Rational Functional Tester . These issues were disclosed as part of the IBM Java SDK updates in April 2015 This bulletin also addresses FREAK: “Factoring Attack on RSA-EXPORT keys” SSL/TLS vulnerability and RC4 Bar Mitzvah Attack for SSL/TLS vulnerability.

Vulnerability Details

CVEID: CVE-2015-0491 Description: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact. CVSS Base Score: 10 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102329&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0459 Description: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact. CVSS Base Score: 10 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102328&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0469 Description: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact. CVSS Base Score: 10 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102327&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0458 Description: An unspecified vulnerability related to the Deployment component has complete confidentiality impact, complete integrity impact, and complete availability impact. CVSS Base Score: 7.6 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102332&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0480 Description: A directory traversal vulnerability related to the Tools component and the extraction of JAR archive files could allow remote attcker to overwrite files on the system with privileges of another user. CVSS Base Score: 5.8 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102334&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVEID: CVE-2015-0486 Description: An unspecified vulnerability related to the Deployment component could allow a remote attacker to obtain sensitive information. CVSS Base Score: 5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102335&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-0488 Description: An unspecified vulnerability related to the JSSE component could allow a remote attacker to cause a denial of service. CVSS Base Score: 5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102336&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0477 Description: An unspecified vulnerability related to the Beans component has no confidentiality impact, partial integrity impact, and no availability impact. CVSS Base Score: 4.3 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102337&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to retrieve credit card data or other sensitive information. This vulnerability is commonly referred to as “Bar Mitzvah Attack”. CVSS Base Score: 5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/101851&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-1916 Description: Server applications which use the IBM Java Secure Socket Extension provider to accept SSL/TLS connections are vulnerable to a denial of service attack due to an unspecified vulnerability. CVSS Base Score: 5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/101995&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-1914 Description: A vulnerability in the IBM implementation of the Java Virtual Machine may allow untrusted code running under a security manager to bypass permission checks and view sensitive information. CVSS Base Score: 4.3 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/101908&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-0192 Description: :A vulnerability in the IBM implementation of the Java Virtual Machine may, under limited circumstances, allow untrusted code running under a security manager to elevate its privileges. CVSS Base Score: 6.8 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/101008&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-0204 Description: A vulnerability in the OpenSSL ssl3_get_key_exchange function could allow a remote attacker to downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers. This vulnerability is also known as the FREAK attack. CVSS Base Score: 4.3 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/99707&gt; for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

All versions of Rational Functional Tester from 8.2.0.0 through 8.6.0.3

Remediation/Fixes

Vendor Fixes:

**Note:**For information about how to install iFixes, see Installing packages.

Workarounds and Mitigations

None