Security Bulletin: Multiple vulnerabilities in Apache Commons FileUpload affect IBM InfoSphere Information Server

Summary

Multiple vulnerabilities in Apache Commons FileUpload used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive.
CVSS Base Score: 5.3
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/114336&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to execute arbitrary code under the context of the current process.
CVSS Base Score: 9.8
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/117957&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

The following product, running on all supported platforms, is affected:
IBM InfoSphere Information Server: versions 11.3, 11.5, and 11.7
IBM InfoSphere Information Server on Cloud: versions 11.5, and 11.7

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Remediation/First Fix

—|—|—|—

InfoSphere Information Server, Information Server on Cloud

|

11.7

|

JR61031

|

--Apply InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server 11.7.1.0 Service Pack 1

InfoSphere Information Server, Information Server on Cloud

|

11.5

|

JR61031

|

--Apply InfoSphere Information Server version 11.5.0.2
--Apply InfoSphere Information Server 11.5.0.2 Service Pack 6

InfoSphere Information Server

|

11.3

|

JR61031

|

--Upgrade to a release where this issue is fixed.

For Information Server 11.3, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

** Contact Technical Support:**
In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.

Workarounds and Mitigations

None