Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 affect IBM Content Collector for SAP Applications (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)

2018-06-1712:12:02

www.ibm.com

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in July 2015.

Vulnerability Details

CVEID: CVE-2015-2613**
DESCRIPTION:** An unspecified vulnerability related to the JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104734 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: _CVE-2015-2601
_DESCRIPTION: An unspecified vulnerability related to the JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104733 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-2625**
DESCRIPTION:** An unspecified vulnerability related to the JSSE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104743 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-1931**
DESCRIPTION:** IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102967 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Content Collector for SAP Applications V4.0
IBM Content Collector for SAP Applications V3.0
IBM Content Collector for SAP Applications V2.2

Remediation/Fixes

IBM provides patches for the affected version. Follow the installation instructions in the README files that is included in the patch.

*Product*	*VRMF*	*APAR*	*Remediation/First Fix*
IBM Content Collector for SAP Applications	2.2.0	HE12378	Apply JRE update 2.2.0.2-ICCSAP-Server-JRE-6.0.16.7, and 2.2.0.2-ICCSAP-Client-JRE-6.0.16.7, which are available from Fix Central
IBM Content Collector for SAP Applications	3.0.0	HE12379	Apply JRE update 3.0.0.2-ICCSAP-Server-JRE-7.0.9.10, and 3.0.0.2-ICCSAP-Client-JRE-7.0.9.10, which are available from Fix Central
For the download details, see <http://www.ibm.com/support/docview.wss?uid=swg24040524>.
IBM Content Collector for SAP Applications	4.0.0	HE12380	Apply JRE update 4.0.0.0-ICCSAP-Base-JRE-7.0.9.10, which is available from Fix Central
For the download details, see <http://www.ibm.com/support/docview.wss?uid=swg24040525>.

CPENameOperatorVersion
ibm content collector for sap applicationseq4.0.0
ibm content collector for sap applicationseq3.0.0
ibm content collector for sap applicationseq2.2.0