Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with IBM Support Assistant Team Server (CVE-2016-0359, CVE-2016-0378, CVE-2016-5986)

Summary

WebSphere Application Server is shipped with IBM Support Assistant Team Server. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2016-0359 **
DESCRIPTION:** IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information.

CVSS Base Score: 6.1 CVSS Temporal Score:See <https://exchange.xforce.ibmcloud.com/vulnerabilities/111929&gt; for the current score CVSS Environmental Score: Undefined
CVSS Vector:* (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2016-0378** **
DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by improper handling of exceptions when a default error page does not exist.

CVSS Base Score: 3.7 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112240&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-5986** **
DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the improper handling of responses under certain conditions. An attacker could exploit this vulnerability to gain server identification information.

CVSS Base Score: 3.7 CVSS Temporal Score:See <https://exchange.xforce.ibmcloud.com/vulnerabilities/116556&gt; for the current score CVSS Environmental Score: Undefined
CVSS Vector:* (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Support Assistant Team Server: 5.0.0 - 5.0.2.2

Remediation/Fixes

The recommended solution is to install the new IBM Support Assistant Team Server 5.0.2.3:http://www-01.ibm.com/software/support/isa/teamserver.html

Workarounds and Mitigations

None