Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System (CVE-2014-6512, CVE-2014-6457)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by IBM Security SiteProtector System. These issues were disclosed as part of the IBM Java SDK updates in October 2014.

Vulnerability Details

CVEID: CVE-2014-6512

DESCRIPTION: An unspecified vulnerability related to the Libraries component has no confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97147 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-6457

DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.

CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97148 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

Affected Products and Versions

IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1

Remediation/Fixes

Apply the appropriate eXPress Updates (XPUs) as identified in the SiteProtector Console Agent view:

For SiteProtector 3.0:

SiteProtector Core Component: ServicePack3_0_0_7.xpu
Event Collector Component: RSEvntCol_WINNT_ST_3_0_0_6.xpu
Agent Manager Component: AgentManager_WINNT_XXX_ST_3_0_0_37.xpu

For SiteProtector 3.1.0:

SiteProtector Core Component: ServicePack3_1_0_4.xpu
Event Collector Component: RSEvntCol_WINNT_ST_3_1_0_4.xpu
Agent Manager Component: AgentManager_WINNT_XXX_ST_3_0_0_19.xpu

For SiteProtector 3.1.1:

SiteProtector Core Component: ServicePack3_1_1_2.xpu
Event Collector Component: RSEvntCol_WINNT_ST_3_1_1_2.xpu
Agent Manager Component: AgentManager_WINNT_XXX_ST_3_0_0_7.xpu
Update Server Component: UpdateServer_3_1_1_2.pkg
Event Archiver Component: EventArchiver_3_1_1­_2.pkg
Event Archiver Importer Component: EventArchiverImporter_3_1_1_2.zip
Manual Upgrader Component: MU_3_1_1_3.xpu

Workarounds and Mitigations

None