Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Security SiteProtector System. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017.

Vulnerability Details

CVEID: CVE-2017-10115

DESCRIPTION: An unspecified vulnerability related to the Java SE JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.

CVSS Base Score: 7.5

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128876 for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-10116

DESCRIPTION: An unspecified vulnerability related to the Java SE Security component could allow an unauthenticated attacker to take control of the system.

CVSS Base Score: 8.3

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128877 for the current score

CVSS Environmental Score*: UndefinedCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID: CVE-2017-10102

DESCRIPTION: An unspecified vulnerability related to the Java SE RMI component could allow an unauthenticated attacker to take control of the system.CVSS Base Score: 9

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128863 for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVEID: CVE-2017-10053

DESCRIPTION: An unspecified vulnerability related to the Java SE 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

CVSS Base Score: 5.3

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128822 for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM Security SiteProtector System 3.0 and 3.1.1

Remediation/Fixes

Apply the appropriate eXPress Updates (XPUs) as identified in the SiteProtector Console Agent view:

For SiteProtector 3.0:

SiteProtector Core Component

|

ServicePack3_0_0_17.xpu

—|—

SiteProtector Agent Manager

|

AgentManager_WINNT_XXX_ST_3_0_0_81.xpu

SiteProtector Event Collector

|

RSEvntCol_WINNT_XXX_ST_3_0_0_14.xpu

For SiteProtector 3.1.1:

SiteProtector Core Component

|

ServicePack3_1_1_13.xpu

—|—

Alternatively, the packages can be manually obtained from the IBM Security License Key and Download Center using the following URL:

<https://ibmss.flexnetoperations.com/service/ibms/login&gt;