Security Bulletin: Vulnerability in IBM Java SDK affects IMS™ Enterprise Suite: Explorer for Development (CVE-2018-1656, CVE-2018-12539)

Summary

There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.15 and earlier that is used by IMS™ Enterprise Suite: Explorer for Development. This issue was disclosed as part of the IBM Java SDK updates in July 2018.

Vulnerability Details

CVE-2018-1656 (CVSS 7.4)

Description

The IBM Java Runtime Environment’s Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.

The fix ensures that malicious zip files are handled gracefully.

CVE-2018-12539 (CVSS 8.4)

Description

The IBM Java Runtime Environment’s Late Attach mechanism can be compromised by an attacker with access to the same local environment as the target JVM. The attack allows arbitrary code to be injected.

Various security enhancements ensure that the Late Attach mechanism cannot be compromised in this way.

Affected Products and Versions

Explorer for Development of the IMS™ Enterprise Suite Versions 3.3.1 and earlier.

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Download URL

—|—|—|—

IMS Enterprise Suite Explorer for Development V3.3

|

3.3.1.10

|

N/A

|

_https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/_

IMS Enterprise Suite Explorer for Development V3.2

|

_ 3.2.1.16_

|

N/A

|

_https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/_