logo
DATABASE RESOURCES PRICING ABOUT US

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum LSF Analytics

Description

## Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™Version 7 used by IBM Spectrum LSF Analytics. IBM Spectrum LSF Analytics has addressed the applicable CVEs. ## Vulnerability Details **CVEID:** [CVE-2019-2699](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2699>) **DESCRIPTION:** Oracle's JREs/JDKs on Windows ship with an old version of a Microsoft DLL which contains a vulnerability. CVSS Base Score: 9 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159791> for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) **CVEID:** [CVE-2019-2698](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2698>) **DESCRIPTION:** An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code. CVSS Base Score: 8.1 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159790> for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) **CVEID:** [CVE-2019-2697](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2697>) **DESCRIPTION:** An attacker can use a maliciously crafted font to exploit a flaw in the JDK's font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code. CVSS Base Score: 8.1 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159789> for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) **CVEID:** [CVE-2019-2602](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2602>) **DESCRIPTION:** A flaw in the java.math.BigDecimal API causes hangs when parsing certain String values. This potentially allows an attacker to inflict a denial-of-service. CVSS Base Score: 7.5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159698> for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) **CVEID:** [CVE-2019-2684](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2684>) **DESCRIPTION:** The Java runtime's java.rmi.Registry implementation does not check access privileges correctly for some remote calls. This allows an attacker to effectively replace a number of predefined static skeleton classes with dynamic malicious skeletons. CVSS Base Score: 5.9 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159776> for more information CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID:** [CVE-2019-10245](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10245>) **DESCRIPTION:** A flaw in the OpenJ9 class verifier potentially allows untrusted code to elevate its privileges and execute arbitrary code. CVSS Base Score: 7.5 CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160010> for more information CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ## Affected Products and Versions Spectrum LSF Analytics 9.1.4 ## Remediation/Fixes _<Product_ | _VRMF_ | _APAR_ | _Remediation/First Fix_ ---|---|---|--- Spectrum LSF Analytics | _9.1.4_ | _None_ | 1. Download IBM JRE 7 from the following location: <http://www.ibm.com/support/fixcentral> by keyword ‘Runtimes for Java Technology’. (The followings steps are using x86_64 as an example.) 2. Copy JRE package into the Analytics Server host and Analytics Node host(s). 3. On the Analytics Server host, stop pats, pars, and parb services 4. On the Analytics Server host, extract new JRE files and replace old JRE files in following directories #{ANALYTICS_SERVER_TOP}\jre #{ANALYTICS_SERVER_TOP}\report\jre Where ANALYTICS_SERVER_TOP describes the top-level IBM Spectrum LSF Analytics server installation directory. 5. On the Analytics Server host, start pats, pars, and parb services on demand. 6. On the Analytics Node host, stop plc services 7. On the Analytics Node host, extract new JRE files and replace old JRE files in following directory #{ANALYTICS_NODE_TOP}/jre/#{ARCH}/ Where ANALYTICS_NODE_TOP describes the top-level IBM Spectrum LSF Analytics node installation directory. ARCH describes the architecture of Analytics Node host. E.g. linux-x86_64 8. On the Analytics Node host, start plc service. ## Workarounds and Mitigations N/A ## Get Notified about Future Security Bulletins Subscribe to [My Notifications](< http://www-01.ibm.com/software/support/einfo.html>) to be notified of important product support alerts like this. ### References [Complete CVSS v3 Guide](<http://www.first.org/cvss/user-guide> "Link resides outside of ibm.com" ) [On-line Calculator v3](<http://www.first.org/cvss/calculator/3.0> "Link resides outside of ibm.com" ) Off ## Related Information [IBM Secure Engineering Web Portal](<http://www.ibm.com/security/secure-engineering/bulletins.html>) [IBM Product Security Incident Response Blog](<http://www.ibm.com/blogs/psirt>) ## Change History May 4, 2019 : original version *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. ## Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. ## Document Location Worldwide [{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SS8U32","label":"IBM Spectrum LSF Analytics"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"","label":""}}]


Affected Software


CPE Name Name Version
Spectrum LSF Analytics 9.1.4

Related