Security Bulletin: Multiple vulnerabilities in IBM Java Runtime Affect IBM Sterling External Authentication Server

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. IBM Sterling External Authentication Server has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2020-14781
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190099 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2020-14782
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190100 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2020-27221
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)
| Version(s)

—|—
IBM Secure External Authentication Server| 6.0.2
IBM Secure External Authentication Server| 6.0.1
IBM Sterling External Authentication Server| 2.4.3.2

Remediation/Fixes

Product |

VRMF

|

iFix

|

Remediation/First Fix

—|—|—|—

IBM Secure External Authentication Server

|

6.0.2.0

|

iFix 3_
_

|

Fix Central

IBM Secure External Authentication Server

|

6.0.1.1

|

6.0.2.0 iFix 3_
_

|

Fix Central

IBM Sterling External Authentication Server

|

2.4.3.2

|

iFix 12

|

Fix Central

Workarounds and Mitigations

None