Security Bulletin: IBM Sterling Control Center v6.2.1 and v6.3.1 is vulnerable with IBM Semeru Runtime Quarterly CPU - Apr 2023

Summary

IBM Semeru Runtime Quarterly CPU - Apr 2023 - Includes OpenJDK April 2023 CPU plus CVE-2023-25193 and CVE-2023-2597 and affecting Sterling Control Center v6.2.1 and v6.3.1.

Vulnerability Details

CVEID:CVE-2023-21930
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow an unauthenticated attacker to cause high confidentiality impact and high integrity impact.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2023-21967
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow a remote attacker to cause high availability impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253156 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-21939
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Swing component could allow a remote attacker to cause integrity impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253168 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2023-21968
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE and GraalVM Enterprise Edition related to the Libraries component could allow an unauthenticated attacker to cause low integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253083 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2023-21937
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Networking component could allow a remote attacker to cause integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253167 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2023-21938
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Libraries component could allow a remote attacker to cause integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253155 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2023-25193
**DESCRIPTION:**Harfbuzz is vulnerable to a denial of service, caused by an error in hb-ot-layout-gsubgpos.hh. By using consecutive marks during the process of looking back for base glyphs when attaching marks, a remote attacker could exploit this vulnerability to trigger O(n^2) growth and cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246411 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-2597
**DESCRIPTION:**Eclipse Openj9 is vulnerable to a buffer overflow, caused by improper bounds checking by the getCachedUTFString() function. By using specially crafted input, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255906 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2023-2004
**DESCRIPTION:**FreeType is vulnerable to a denial of service, caused by an integer overflow in the tt_hvadvance_adjust() function in src/truetype/ttgxvar.c. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/252826 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Product

|

Version

|

Remediation

—|—|—

IBM Sterling Control Center

|

6.3.1.0 GA through iFix02

|

6.3.1.0 iFix02 Fix Central - 6.3.1.0

IBM Sterling Control Center

|

6.2.1.0 GA through iFix13

|

6.2.1.0 iFix13 Fix Central - 6.2.1.0

Workarounds and Mitigations

• Analysis on CVE’s for 6.3.1:
  • CVE-2023-21930, It is fixed in 17.0.7
  • CVE-2023-21967, It is fixed in 17.0.7
  • CVE-2023-21939, It is fixed in 17.0.7
  • CVE-2023-21968, It is fixed in 17.0.7
  • CVE-2023-21937, It is fixed in 17.0.7
  • CVE-2023-21938, It is fixed in 17.0.7
  • CVE-2023-25193, It is fixed in 17.0.7
  • CVE-2023-2597, It is fixed in 17.0.7
  • CVE-2023-2004 - Not a security issue. CVE Withdrawn. Ref- <https://vulners.com/cve/CVE-2023-2004&gt;
• Above vulnerabilities are fixed in 6.3.1 ifix02 with the upgrade of java version to 17.0.10.
• Analysis on CVE’s for 6.2.1:
  • CVE-2023-21930 - fixed in 8.0.8.5.
  • CVE-2023-21967 - fixed in 8.0.8.5.
  • CVE-2023-21939 - fixed in 8.0.8.5.
  • CVE-2023-21968 - fixed in 8.0.8.5.
  • CVE-2023-21937 - fixed in 8.0.8.5.
  • CVE-2023-21938 - fixed in 8.0.8.5.
  • CVE-2023-25193 - Not applicable to IBM JRE/SDK
  • CVE-2023-2597 - fixed in 8.0.8.5. Current Version - 8.0.8.20 in recent ifix,
  • CVE-2023-2004 - <https://nvd.nist.gov/vuln/detail/CVE-2023-2004&gt; - Not a security issue.
• Above vulnerabilities are fixed in 6.2.1 ifix13 with the java version upgrade to 8.0.8.20.