Security Bulletin: A vulnerability in Apache ActiveMQ affects IBM Tivoli System Automation Application Manager (CVE-2015-5254)

Summary

There is a vulnerability in Apache ActiveMQ that is used by IBM Tivoli System Automation Application Manager.

Vulnerability Details

CVEID: CVE-2015-5254 DESCRIPTION: Apache ActiveMQ could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the classes that can be serialized in the broker. An attacker could exploit this vulnerability using a specially crafted serialized Java Message Service (JMS) ObjectMessage object to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109632 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM Tivoli System Automation Application Manager 4.1 and 3.2.2

Remediation/Fixes

The recommended solution is to apply the fix to IBM Tivoli System Automation Application Manager. Please see below for information on the fixes available.

• If you are running IBM Tivoli System Automation Application Manager 4.1, please apply interim fix “4.1.0.1-TIV-SAAM-<OS>-IF0101” where <OS> represents the operating system for which you want to install the fix of this product version. You can apply this iFix on top of any fixpack of version 4.1.
• If you are running IBM Tivoli System Automation Application Manager 3.2.2, please interim fix “3.2.2.3-TIV-SAAM-<OS>-IF0101” where <OS> represents the operating system for which you want to install the fix of this product version. You can apply this iFix on top of any fixpack of version 3.2.2.

Please note that both IBM Tivoli System Automation Application Manager 3.2.1 and IBM Tivoli System Automation Application Manager 3.2.0 are not affected by this security vulnerability as those two releases do not use Apache ActiveMQ.

Workarounds and Mitigations

None