Security Bulletin: IBM Tivoli Monitoring embedded WebSphere Application Server (CVE-2015-1920)

Summary

The following security issue has been identified in WebSphere Application Server included as part of IBM Tivoli Monitoring (ITM) portal server.

Vulnerability Details

CVEID: CVE-2015-1920**
DESCRIPTION:** WebSphere Application Server could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.
CVSS Base Score: 9.3
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/102404&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Affected Products and Versions

The following component of IBM Tivoli Monitoring (ITM) is affected by the this vulnerability:
- Tivoli Enterprise Portal Server (TEPS) - embedded WebSphere Application Server – ITM versions 6.2.0 and higher

Remediation/Fixes

**

_Portal Server - _

**embedded WebSphere Application Server

Note the patch below is the same patch that was provided for the Logjam security vulnerability. If already installed, then nothing additional is required. <http://www.ibm.com/support/docview.wss?uid=swg21962739&gt;.

For IBM Tivoli Monitoring 6.2.0 and 6.2.1, IBM recommends upgrading to a fixed, supported version/release of the product as listed above.

You should verify applying this fix does not cause any compatibility issues.