Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Netcool Impact (CVE-2015-2017)

Summary

IBM WebSphere Application Server is shipped as a component of Tivoli Netcool/Impact. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Please consult the security bulletin Security Bulletin: HTTP response splitting attack in WebSphere Application Server (CVE-2015-2017) for vulnerability details and information about fixes.

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
Tivoli Netcool/Impact 5.1.1| WebSphere 6.1
Tivoli Netcool/Impact 6.1.x| WebSphere 7.0
Tivoli Netcool/Impact 7.1.0| WebSphere Liberty Profile 8.5.5

Remediation/Fixes

VRMF

| Websphere release level| Remediation
—|—|—
5.1.1

| 6.1

| Upgrade to WebSphere Application Server Fix Pack 6.1.0.47 and then apply Interim Fix PI45266

For details of how to upgrade Websphere see the latest 5.1.1 Netcool Impact FP readme: <http://www.ibm.com/support/docview.wss?uid=swg24036880&gt;
6.1.*| 7.0| This vulnerability fixed in WebSphere Application Server Fix pack 7.0.0.39. See link for details.

<ftp://ftp.software.ibm.com/software/websphere/appserv/support/fixpacks/was70/cumulative/cf70039/&gt;

For instruction on how to upgrade Websphere see the latest 6.1.* Netcool Impact FP readme.
7.1.0.0
7.1.0.1| 8.5.5.2| Move to 7.1.0-TIV-NCI-FP0003 and apply Interim Fix PI45266.

7.1.0-TIV-NCI-FP0003 is available here:
<http://www.ibm.com/support/docview.wss?uid=swg24040149&gt;
7.1.0.2| 8.5.5.4| Move to 7.1.0-TIV-NCI-FP0003 and apply Interim Fix PI45266.

7.1.0-TIV-NCI-FP0003 is available here:
<http://www.ibm.com/support/docview.wss?uid=swg24040149&gt;
7.1.0.3| 8.5.5.6| Apply Interim Fix PI45266.
7.1.0.4 (future release)| 8.5.5.6+PI45266| Impact 7.1.0.4 (due Q4 2015 *) will update Websphere Liberty Profile with fix for PI45266. No further action is required to manually update WLP.

* Note this date is a scheduled date and does not represent a formal commitment by IBM.
(future release)| 8.5.5.8 (future release)| Plans to update Websphere Liberty Profile to version 8.5.5.8 (planned for release mid-Dec 2015*) are included for the next service release for Impact (due Q2 2016 *)

* Note this date is a scheduled date and does not represent a formal commitment by IBM.