Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMF3DADED115C455258153CDABAC2AB33D9397F6285472C1AE6891D5942E4259ED
HistoryJun 15, 2018 - 7:03 a.m.

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID)

2018-06-1507:03:23
www.ibm.com
2

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Summary

There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by IBM Integration Designer (IID) and WebSphere Integration Developer (WID). These issues were disclosed as part of the IBM Java SDK updates in April 2015.

In addition, the LogJam Attack on TLS connections using the Diffie-Hellman (DH) key exchange protocol also affects IBM Integration Designer (IID) and WebSphere Integration Developer (WID).

Vulnerability Details

CVEID:CVE-2015-0478**
DESCRIPTION:** An unspecified vulnerability related to the JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/102339&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID:CVE-2015-0488**
DESCRIPTION:** An unspecified vulnerability related to the JSSE component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102336 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID:CVE-2015-1916**
DESCRIPTION:** Server applications which use the IBM Java Secure Socket Extension provider to accept SSL/TLS connections are vulnerable to a denial of service attack due to an unspecified vulnerability.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101995 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-4000**
DESCRIPTION:** The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as “Logjam”.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103294 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

These vulnerabilities affect:

  • WebSphere Integration Developer V7.0.0.x
  • IBM Integration Designer V7.5.x
  • IBM Integration Designer V8.0.1.x
  • IBM Integration Designer V8.5.0.x
  • IBM Integration Designer V8.5.5
  • IBM Integration Designer V8.5.6

Remediation/Fixes

To fully mitigate these vulnerabilities, an additional fix for IBM Integration Designer and WebSphere Integration Developer is required (JR53593):

* [_WebSphere Integration Developer V7.0.0.x_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FWebSphere+Integration+Developer&fixids=7.0.0.5-WS-IID-IFJR53593&source=SAR&gt;)
* [_IBM Integration Designer V7.5.x_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Integration+Designer&fixids=7.5.1.2-WS-IID-IFJR53593&source=SAR&gt;)
* [_IBM Integration Designer V8.0.1.x_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Integration+Designer&fixids=8.0.1.3-WS-IID-IFJR53593&source=SAR&gt;)
* [_IBM Integration Designer V8.5.0.x_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Integration+Designer&fixids=8.5.0.1-WS-IID-IFJR53593&source=SAR&gt;)
* [_IBM Integration Designer V8.5.5_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Integration+Designer&fixids=8.5.5.0-WS-IID-IFJR53593&source=SAR&gt;)
* [_IBM Integration Designer V8.5.6_](&lt;http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Integration+Designer&fixids=8.5.6.0-WS-IID-IFJR53593&source=SAR&gt;)

Workarounds and Mitigations

None

Related

ibm 134
f5 2
nessus 25
prion 4
cve 3
cvelist 3
ubuntucve 2
debiancve 3
threatpost 1
fortinet 1
atlassian 3
fedora 5
openvas 8
aix 1
veracode 1
osv 1
mageia 1
centos 1
ibm
ibm
Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect server products in WebSphere Dynamic Process Edition (CVE-2015-4000)
2018-06-15 07:03:11
Security Bulletin: Multiple security vulnerabilities have been identified in bundled products shipped with WebSphere Dynamic Process Edition (April 2015)
2018-06-15 07:03:13
Security Bulletin: Multiple vulnerabilities in IBM Java SDK and in Diffie-Hellman ciphers affects IBM InfoSphere Information Server (CVE-2015-0478 CVE-2015-0488 CVE-2015-1916 CVE-2015-4000)
2018-06-16 14:07:49
f5
f5
SOL17136 - Java and JRockit vulnerabilities CVE-2015-0478 and CVE-2015-0488
2015-08-24 00:00:00
K17136 : Java and JRockit vulnerabilities CVE-2015-0478 and CVE-2015-0488
2015-08-24 00:00:00
nessus
nessus
Oracle JRockit R28.3.5 Multiple Vulnerabilities (April 2015 CPU) (FREAK)
2015-04-16 00:00:00
SUSE SLED11 / SLES11 Security Update : MySQL (SUSE-SU-2015:1177-1) (Logjam)
2015-07-06 00:00:00
AIX 7.1 TL 2 : sendmail (IV75645) (Logjam)
2015-08-11 00:00:00
prion
prion
Code injection
2015-07-02 21:59:00
Buffer overflow
2015-04-16 16:59:00
Buffer overflow
2015-04-16 16:59:00
cve
cve
CVE-2015-1916
2015-07-02 21:59:00
CVE-2015-0478
2015-04-16 16:59:00
CVE-2015-0488
2015-04-16 16:59:00
cvelist
cvelist
CVE-2015-1916
2015-07-02 21:16:00
CVE-2015-0478
2015-04-16 16:00:00
CVE-2015-0488
2015-04-16 16:00:00
ubuntucve
ubuntucve
CVE-2015-0478
2015-04-15 00:00:00
CVE-2015-0488
2015-04-15 00:00:00
debiancve
debiancve
CVE-2015-0478
2015-04-16 16:59:00
CVE-2015-0488
2015-04-16 16:59:00
CVE-2015-4000
2015-05-21 00:59:00
threatpost
threatpost
Flawed TLS Implementations Leak RSA Keys
2015-09-08 15:09:28
fortinet
fortinet
CVE-2015-4000 "Logjam" attack
2015-05-20 00:00:00
atlassian
atlassian
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:35:17
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:35:17
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:43:18
fedora
fedora
[SECURITY] Fedora 22 Update: nss-3.19.1-1.0.fc22
2015-06-02 15:17:04
[SECURITY] Fedora 21 Update: nss-util-3.19.1-1.0.fc21
2015-06-01 17:06:27
[SECURITY] Fedora 21 Update: nss-softokn-3.19.1-1.0.fc21
2015-06-01 17:06:26
openvas
openvas
SSL/TLS: 'DHE_EXPORT' Man in the Middle Security Bypass Vulnerability (LogJam)
2015-05-22 00:00:00
SUSE: Security Advisory (SUSE-SU-2015:1526-1)
2021-06-09 00:00:00
Debian: Security Advisory (DLA-507-1)
2023-03-08 00:00:00
aix
aix
Vulnerability in Diffie-Hellman ciphers affects sendmail on AIX,Vulnerability in Diffie-Hellman ciphers affects sendmail on VIOS
2015-08-07 15:15:59
veracode
veracode
Man-in-the-Middle (MitM)
2019-01-15 09:06:07
osv
osv
nss - security update
2016-06-07 00:00:00
mageia
mageia
Updated filezilla package fixes security vulnerability
2015-07-05 20:22:03
centos
centos
openssl security update
2015-06-04 19:47:16

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON
Related for F3DADED115C455258153CDABAC2AB33D9397F6285472C1AE6891D5942E4259ED
ibm134f52nessus25prion4cve3cvelist3ubuntucve2debiancve3threatpost1fortinet1atlassian3fedora5openvas8aix1veracode1osv1mageia1centos1