Security Bulletin: Security vulnerabilities have been identified in IBM DB2, which shipped with IBM SmartCloud Orchestrator (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM SmartCloud Orchestrator. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details Review the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities CVE-2013-6747,...

Security Bulletin: IBM SmartCloud Orchestrator - OpenStack Compute SSL information disclosure (CVE-2013-6491)

Summary An attacker might exploit this vulnerability using man-in-the-middle techniques to obtain sensitive information. The python-qpid client common/rpc/implqpid.py in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpidprotocol is set to ssl. It allows remote attackers to...

Security Bulletin: Vulnerabilities in tomcat affect IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance (CVE-2013-4590, CVE-2014-0119)

Summary Vulnerabilities in tomcat6 packages affect IBM SmartCloud Provisioning 2.1 for Provided Software Virtual Appliance CVE-2013-4590, CVE-2014-0119. Vulnerability Details CVEID: CVE-2013-4590 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with SmartCloud Cost Management (SCCM/TUAM) (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of SmartCloud Cost Management SCCM/TUAM. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM® DB2® is impacted by multiple TLS/SSL security...

Security Bulletin: IBM Prospect is affected by Expat XML Parser vulnerability (CVE-2013-0340)

Summary Prospect Core 8.0.7 Server is impacted by a denial of service vulnerability in Expat caused by the improper handling of internal entity expansion. Vulnerability Details CVEID: CVE-2013-0340 DESCRIPTION: Expat is vulnerable to a denial of service, caused by the improper handling of interna...

Security Bulletin: Pivotal Spring Framework vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM)

Summary Multiple vulnerabilities have been identified in the OpenSource/Pivotal Spring Framework version that is embeddded in IBM Tivoli Application Dependency Discovery Manager TADDM thus requiring an upgrade to Spring Framework version 3.2.13. Vulnerability Details CVEID: CVE-2014-3578...

Security Bulletin: IBM Tivoli Monitoring affected by vulnerabilities in IBM® SDK, Java™ Technology Edition

Summary The vulnerabilities listed below have been identified in the IBM® SDK, Java™ Technology Edition Java Runtime Environment JRE which is installed into the IBM Tivoli Monitoring installation directory for example, CANDLEHOME. This is an embedded JRE is used by various IBM Tivoli Monitoring...

Security Bulletin: TSM client metadata local unauthorized access (CVE-2013-6335)

Summary IBM Tivoli Storage Manger TSM for Space Management files can be restored incorrectly by the TSM Backup-Archive client, potentially allowing unauthorized local access to those files. Vulnerability Details CVE ID: CVE-2013-6335 Description: The file metadata of TSM for Space Management file...

Security Bulletin: Vulnerabilities in IBM Tivoli Monitoring agent and shared library with potential for privilege escalation (CVE-2013-5467)

Summary Privilege escalation vulnerability in an IBM Tivoli Monitoring ITM agent could be exploited by a local user to gain elevated privilege of another user. This vulnerability also affects a shared library shipped with all ITM components and agents. Vulnerability Details CVEID: CVE-2013-5467...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions is affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450 and CVE-2013-6449)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2013-4353 DESCRIPTION: A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue...

Security Bulletin:Security vulnerabilities have been identified in IBM® DB2® shipped with Tivoli Network Manager (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of Tivoli Network Manager. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities...

Security Bulletin: Privilege Escalation Vulnerability in the Data Protection for VMware GUI (CVE-2013-6713)

Summary In customer environments that utilize VMware restricted users, users of the Tivoli Storage Manager for Virtual Environments: Data Protection for VMware GUI can back up and restore VMs that they are not authorized to access. Vulnerability Details CVE ID: CVE-2013-6713 DESCRIPTION: In...

Security Bulletin: Privilege Escalation Vulnerability in the FlashCopy Manager for VMware GUI (CVE-2013-6714)

Summary In customer environments that utilize VMware restricted users, users of the Tivoli Storage FlashCopy Manager: FlashCopy Manager for VMware GUI can back up and restore VMs that they are not authorized to access. Vulnerability Details CVE ID: CVE-2013-6714 DESCRIPTION: In customer...

Security Bulletin: TADDM - Security improvement: Tomcat default files and non-encrypted administrative interfaces available.

Summary TADDM security improvement deployed starting from TADDM 7.2.1.5 and in TADDM 7.2.2 related to availability of the default Tomcat administration interface. Vulnerability Details CVE-2013-3023 Description TADDM server prompts for credentials to access Tomcat Manager Application and Tomcat...

Security Bulletin: TADDM – Security improvement: More restricted permission on TADDM files on UNIX-like servers.

Summary TADDM security improvement deployed started from TADDM 7.2.1.5 and in TADDM 7.2.2 that restrict access to TADDM files on UNIX-like servers. Vulnerability Details CVE-2013-4040 Description Default TADDM file permission on UNIX-like servers, by default are 755 rwx r-x r-x, that allow all...

Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Service Monitors is affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450 and CVE-2013-6449)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2013-4353 DESCRIPTION: A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue...

Security Bulletin: Cross-site scripting in Oauth (CVE-2013-6738)

Summary Cross-site scripting in Oauth Vulnerability Details CVE ID: CVE-2013-6738 DESCRIPTION: OAuth /authorize endpoint will return an invalid query param in the response. This allows a script to be injected in the response. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See for the current sco...

Security Bulletin: IBM Tivoli Network Manager - GSKit Security Vulnerabilities (CVE-2013-0169), (CVE-2012-2190) and (CVE-2013-0166)

Summary OpenSSL Security Advisory updates Feb 2013: GSKit Lucky 13 TLS CBC Timing Attack - CVE-2013-0169. A vulnerability in relation to Session ID Lengths and SSL/TLS Server has been discovered that impacts GSKit - CVE-2012-2190. OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1...

Security Bulletin:Tivoli Multiple vulnerabilities in Netcool/Impact (CVE-2013-5802,,CVE-2013-5825,CVE-2013-5372)

Summary Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with Netcool/Impact. Vulnerability Details Netcool/Impact is shipped with IBM WebSphere Application Server that includes an IBM SDK for Java that is based on the Oracle JDK. Oracle has released October 2013...

Security Bulletin: Multiple vulnerabilities in usage of IBM Java SDK in IBM Content Analytics with Enterprise Search and IBM OmniFind Enterprise Edition (CVE-2013-5802, CVE-2013-4002, CVE-2013-5825, CVE-2013-5372)

Summary Potential security vulnerabilities exist in the IBM Java SDK that is shipped with the IBM Content Analytics with Enterprise Search and IBM OmniFind Enterprise Edition products. Vulnerability Details CVE ID: CVE-2013-5802 DESCRIPTION: JRE vulnerable to denial of service attacks via malform...