Security Bulletin: Vulnerability in Apache Commons affects Rational Directory Server Tivoli and Rational Directory Administrator (CVE-2015-7450)

Summary

An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by the Apache Software Foundation and incorporated into an IBM WebSphere Application Server Liberty fixes.

Vulnerability Details

IBM Rational Directory Server Tivoli and Rational Directory Administrator are affected by the following vulnerability:

CVEID: CVE-2015-7450

**
DESCRIPTION:** Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the system.

CVSS Base Score: 9.8 **CVSS Temporal Score:**See https://exchange.xforce.ibmcloud.com/vulnerabilities/107918 for the current score *CVSS Environmental Score:**Undefined **CVSS Vector: **(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Rational Directory Server Tivoli version 5.2.1

Rational Directory Administrator versions 6.0.0.0, 6.0.0.1, 6.0.0.2

Remediation/Fixes

Fixes for this vulnerability are available from the Apache Software Foundation and included in WebSphere Application Server (WAS) Liberty fixes. The fixes are available on IBM Support: Fix Central.

To apply the fix forRational Directory Server Tivoli** 5.2.1:**

Note: The vulnerability affects the Rational Directory Administrator (RDA) that ships with Rational Directory Server Tivoli.

**Note:**That you must upgrade to WebSphere Application Server Liberty 8.5.0.2 before applying this fix.

1. Open a console and navigate to the location where you downloaded the .jar file for the fix.
2. Run the command: java -jar 8.5.0.2-WS-WASProd_WLPArchive-IFPI52103.jar

The following launch options are available for the jar file:

--installLocation [LibertyRootDir]

By default the jar will look for a “wlp” directory in its current location. The default location is in the following path in the Rational Directory Server installation: WebAppsServer/WLP_<version>. For example, WebAppsServer/WLP_8.5.5.2. If your Liberty profile install location is different than “wlp” and/or it is not in the same directory as the jar, then you can use this option to change where the jar will patch. [LibertyRootDir] can either be relative to the location of the jar or an absolute file path.

--suppressInfo

Hides all messages other than confirming the patch has completed or error messages.
3. Stop Rational Directory Administrator.
4. Start Rational Directory Administrator.
Note: By restarting Rational Directory Administrator, you are restarting the Liberty profile.

To apply the fix forRational DirectoryAdministrator****6.0.0.0, 6.0.0.1 or 6.0.0.2:

Note: You must upgrade to WebSphere Application Server 8.5.5.6 before applying this fix.

1. Open a console and navigate to the location where you downloaded the .jar file for the fix.
2. Run the command: java -jar 8556-wlp-archive-IFPI52103.jar

The following launch options are available for the jar file:

--installLocation [LibertyRootDir]

By default the jar will look for a “wlp” directory in its current location. The default location is in the following path in the Rational Directory Administrator installation: WebAppsServer/WLP_<version>. For example, WebAppsServer/WLP_8.5.5.2. If your Liberty profile install location is different than “wlp” and/or it is not in the same directory as the jar, then you can use this option to change where the jar will patch. [LibertyRootDir] can either be relative to the location of the jar or an absolute file path.

--suppressInfo

Hides all messages other than confirming the patch has completed or error messages.
3. Stop Rational Directory Administrator.
4. Start Rational Directory Administrator.
Note: By restarting Rational Directory Administrator, you are restarting the Liberty profile.

IBM recommends that you review your entire environment to identify vulnerable releases of the open-source Apache Commons Collections and take appropriate mitigation and remediation actions.