Security Bulletin: A security vulnerability in IBM SDK which affects DataQuant for z/OS (CVE-2019-2816, CVE-2019-2766, CVE-2019-11771, CVE-2019-11775, CVE-2019-2786, CVE-2019-11772, CVE-2019-2769, CVE-2019-2762, CVE-2019-7317, CVE-2019-4473)

Summary

A security vulnerability has been identified in IBM SDK that could affect DataQuant for z/OS.

Vulnerability Details

CVEID: CVE-2019-2816

CVSS Base Score: 4.8
**DESCRIPTION:**A flaw in the java.net API incorrectly converts some Unicode characters when converting Internalized Domain Name URLs into KC normalized form. As a result, characters with syntactic significance (colon, slash etc.) can be injected into URLs.
The fix ensures that illegal characters in IDN URLs are detected and handled gracefully.

CVEID: CVE-2019-2766

CVSS Base Score: 3.1
**DESCRIPTION:**A flaw in the java.net component allows untrusted code to elevate its file access privileges.
The fix corrects the flaw.

CVEID: CVE-2019-11771

CVSS Base Score: 8.4
**DESCRIPTION:**On the AIX platform, various binaries in the IBM JRE/SDK contain inappropriate absolute RPATHs, which may allow local users to inject code into JVM processes launched by other users with higher privileges.
The fix removes the unsafe RPATHs.

CVEID: CVE-2019-11775

CVSS Base Score: 8.4
**DESCRIPTION:**A flaw in OpenJ9’s JIT compiler allows untrusted code to elevate its privileges and execute arbitrary code.
The fix corrects the flaw.

CVEID: CVE-2019-2786

CVSS Base Score: 3.4
**DESCRIPTION:**A flaw in the java.security.AccessController API allows untrusted code to elevate its privileges.
The fix corrects the flaw.

CVEID: CVE-2019-11772

CVSS Base Score: 8.4
**DESCRIPTION:**A flaw in OpenJ9’s String.getBytes() implementation allows untrusted code to elevate its privileges and execute arbitrary code.
The fix adds bounds checks to correct the flaw.

CVEID: CVE-2019-2769

CVSS Base Score: 5.3
**DESCRIPTION:**A flaw in the java.util component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.

CVEID: CVE-2019-2762

CVSS Base Score: 5.3
**DESCRIPTION:**A flaw in the java.lang component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.

CVEID: CVE-2019-7317

CVSS Base Score: 6.8
**DESCRIPTION:**A vulnerability in the libpng code which is used by the java.awt.SplashScreen API may allow untrusted code to elevate its privileges.
The fix updates the libpng code to the level which addresses the flaw.

CVEID: CVE-2019-4473

CVSS Base Score: 8.4
**DESCRIPTION:**On the AIX platform, various binaries in the IBM JRE/SDK contain inappropriate absolute RPATHs, which may allow local users to inject code into JVM processes launched by other users with higher privileges.
The fix removes the unsafe RPATHs.

Affected Products and Versions

Principal Products and Versions

DataQuant for z/OS 2.1

Remediation/Fixes

Steps to update JRE - DataQuant:

1. Close DataQuant.
2. Download JRE (ibm-java-jre-80-win-i386) and extract the files to a temporary location.
3. Replace jre folder at the install directory location –> “C:\Program Files (x86)\IBM\IBM DataQuant\DataQuant for Workstation”. Replace with contents in step # 2.
4. Download eclipse oxygen from https://www.eclipse.org/downloads/download.php?file=/technology/epp/downloads/release/oxygen/3a/eclipse-jee-oxygen-3a-win32-x86_64.zip
5. Extract the eclipse oxygen and copy the plugin - org.apache.jasper.glassfish_2.2.2.v201501141630.jar from eclipse-jee-oxygen-3a-win32-x86_64\eclipse\plugins
6. Copy org.apache.jasper.glassfish_2.2.2.v201501141630.jar in the folder where DataQuant is installed - C:\Program Files (x86)\IBM\IBM DataQuant\DataQuant for Workstation\plugins
7. Delete the older plugin org.apache.jasper.glassfish_2.2.2.v201205150955.jar from the DataQuant install directory

Workarounds and Mitigations

None