Security Bulletin: Apache Commons FileUpload Vulnerability Can Affect IBM Sterling Order Management (CVE-2016-1000031)

Summary

IBM Sterling Order Management uses Apache Commons FileUpload and is affected by some of the vulnerabilities that exist in Apache Commons FileUpload.

Vulnerability Details

CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to execute arbitrary code under the context of the current process.
CVSS Base Score: 9.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/117957&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Sterling Selling and Fulfillment Foundation 9.1.0 through 10.0

Remediation/Fixes

The recommended solution is to apply the security fix pack (SFP) as soon as practical. Please see below for information about the available fixes.

Product

|

_Security Fix Pack_*

|

Remediation/First Fix

—|—|—
IBM Sterling Selling and Fulfillment Foundation 10.0 | 10.0-SFP1 | Fix Central_ - Select appropriate VRMF_

IBM Sterling Selling and Fulfillment Foundation 9.5.0

|

9.5.0-SFP4

|

Fix Central _ - Select appropriate VRMF_

IBM Sterling Selling and Fulfillment Foundation 9.4.0

|

9.4.0-SFP5

|

Fix Central _ - Select appropriate VRMF_

IBM Sterling Selling and Fulfillment Foundation 9.3.0

|

9.3.0-SFP7

|

Fix Central _ - Select appropriate VRMF_

IBM Sterling Selling and Fulfillment Foundation 9.2.1

|

9.2.1- SFP8

|

Fix Central _ - Select appropriate VRMF _

IBM Sterling Selling and Fulfillment Foundation 9.2.0

|

9.2.0- SFP8

|

Fix Central _ - Select appropriate VRMF _

IBM Sterling Selling and Fulfillment Foundation 9.1.0

|

9.1.0- SFP8

|

Fix Central _ - Select appropriate VRMF _

Workarounds and Mitigations

None