Security Bulletin: Rational Synergy can be affected by a vulnerabilities in JSSE components (CVE-2013-0440, CVE-2013-0443, CVE-2013-1571, CVE-2013-0169)

Summary

IBM Rational Synergy can be affected by the following vulnerabilities which exist in the IBM Java SDK that is shipped with IBM Rational Synergy.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVEID:CVE-2013-0440
** Description:**Unspecified vulnerability in Java Runtime Environment allows remote attackers to affect availability via vectors related to JSSE.

CVSS Base Score: 5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81799&gt; *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID:CVE-2013-0443

Description: Unspecified vulnerability in Java Runtime Environment allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

CVSS Base Score: 4 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81801&gt; *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVEID:CVE-2013-0169 ** **
Description: The TLS protocol does not properly consider timing side-channel attacks, which allows remote attackers to conduct distinguishing attacks and plain-text recovery attacks via
statistical analysis of timing data for crafted packets, aka the “Lucky Thirteen” issue.

CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/81902&gt; *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID:CVE-2013-1571** **
Description: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the documentation
which injects arbitrary content into the main frame. The injected content appears to originate from the site hosting the documentation, but in fact it is hosted elsewhere, and may
contain malicious links or content. This type of attack is known as “clickjacking”.
The attack does not require authentication and may be exploited remotely if the html page is network available, but some degree of specialized knowledge and techniques are required. An
exploit would not impact the confidentiality of information or the availability of the system, but data integrity could be compromised.

CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/84715&gt; for the current score *CVSS Environmental Score:**Undefined **CVSS Vector: **(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Rational Synergy 7.2.0.4

Remediation/Fixes

Upgrade to Rational Synergy Fix Pack 5 (7.2.0.5) for 7.2

Workarounds and Mitigations

None