Security Bulletin: Integration server HTTP listener exposes stack trace in WebSphere Message Broker and IBM Integration Bus

Summary

Integration server HTTP listener exposes stack trace in WebSphere Message Broker and IBM Integration Bus

Vulnerability Details

CVEID: CVE-2016-2961**
DESCRIPTION:** IBM Integration Bus uses the Apache Tomcat server for serving HTTP requests for the HTTPInput and SOAPInput nodes. A vulnerability exists where an unauthenticated, remote attacker can send a malformed HTTP POST request to the integration server HTTP listener. The attacker could use the information in the Java stack trace to identify the version of Apache Tomcat in use.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113806 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Integration Bus V10.0, V9.0

WebSphere Message Broker V8.0

Remediation/Fixes

Product

| VRMF|APAR|Remediation/Fix
—|—|—|—
IBM Integration Bus| V10| IT15188 | The APAR is available in fix pack 10.0.0.5
IBM Integration Bus

| V9

| IT15188| An interim fix is available from IBM Fix Central for all platforms
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT15188

The APAR is targeted to be available in fix pack 9.0.0.6
WebSphere Message Broker| V8| IT15188| An interim fix is available from IBM Fix Central for all platforms
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Message+Broker&release=All&platform=All&function=aparId&apars=IT15188

The APAR is targeted to be available in fix pack 8.0.0.8

For unsupported versions of the product, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :
http://www.ibm.com/support/docview.wss?uid=swg27006308