Security Bulletin: Vulnerability in Apache Xerces-C XML parser, including XML4C affects IBM InfoSphere Optim Data Growth & Test Data Management & Application Retirement

Summary

Open Source Xerces-C XML parser vulnerability affects IBM InfoSphere Optim Data Growth & Test Data Management & Application Retirement, also known as the server components.

Vulnerability Details

CVEID: CVE-2016-0729
DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during processing and error reporting. By sending specially crafted input documents, an attacker could exploit this vulnerability to cause the library to crash or possibly execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111028 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affects IBM InfoSphere Optim solutions and editions versions 9.1 and 11.3 running on all supported platforms.

Both editions (Enterprise and Workgroup) of the following products are affected:

Optim Archive
Optim Data Privacy
Optim Test Data Management

All variations of the following solutions are affected:

Optim Data Growth Solution
Optim Solution for Application Retirement
Optim Test Data Management Solution

Remediation/Fixes

For the 11.3 release, fix pack 4 (11.3.0.4) and iFix 153 are required before installing iFix 215. That is, install 11.3.0.4, then iFix 153, then iFix 215.

For the 9.1 release, fix pack 6 (9.1.0.6) is required before installing iFix 208.

Workarounds and Mitigations

None