Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693

Summary

A comma separated file (CSV) download feature exists in IBM BPM and WLE and is available for anonymous users. An attacker can craft a URL that can trigger a download of attacker-supplied content under an attacker-supplied file name onto the victim’s machine.

Vulnerability Details

CVEID: CVE-2016-9693**
DESCRIPTION:** IBM Business Process Manager has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim’s machine.
CVSS Base Score: 7.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/119517&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)

Affected Products and Versions

- WebSphere Lombardi Edition V7.2.0.0 - V7.2.0.5
- IBM Business Process Manager Advanced V7.5.0.0 - V7.5.1.2
- IBM Business Process Manager Advanced V8.0.0.0 - V8.0.1.3
- IBM Business Process Manager Advanced V8.5.0.0 - V8.5.7.0 including cumulative fix 2016.12

Remediation/Fixes

Install IBM BPM or WLE interim fix JR57149 as appropriate for your current version.

• IBM Business Process Manager Advanced
• IBM Business Process Manager Standard
• IBM Business Process Manager Express
• WebSphere Lombardi Edition

As IBM Business Process Manager V7.5 and WebSphere Lombardi Edition are out of general support, customers with a support extension contract can contact IBM support to request the fix.

The fix disables the vulnerable URL and uses HTML5 features to trigger CSV download without server interaction.

For WebSphere Lombardi Edition 7.2.0.0 through 7.2.0.5

• Install Fix Pack 5 as required by iFix and then apply iFix JR57149
• For IBM BPM V7.5.0.0 through V7.5.1.2:
• Upgrade to minimal Refresh Pack 1, install Fix Pack 2 as required by iFix and then apply iFix JR57149

For IBM BPM V8.0.0.0 through V8.0.1.3

• Upgrade to minimal Refresh Pack 1, install Fix Pack 3 as required by iFix and then apply iFix JR57149

For IBM BPM V8.5.0.0 through V8.5.0.2

• Install Fix Pack 2 as required by iFix and then apply iFix JR57149

For IBM BPM V8.5.5.0

• Apply iFix JR57149

For IBM BPM V8.5.6.0 through V8.5.6.0 CF2

• Install CF2 as required by iFix and then apply iFix JR57149

For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2016.12

• Install CF 2016.12 and then apply iFix JR57149

Workarounds and Mitigations

None