Security Bulletin: Vulnerabilities in Dojo Toolkit affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-8917)

Summary There are cross-site scripting vulnerabilities in the Dojo Toolkit that is used by IBM Worklight and IBM MobileFirst Platform Foundation. Vulnerability Details CVEID: CVE-2014-8917 DESCRIPTION: IBM Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes the vulnerability that has been referred to as “FREAK”. OpenSSL is used by IBM Worklight and IBM MobileFirst Platform Foundation when the optional FIPS 140-2 data-in-motion feature is enabled o...

Security Bulletin: TLS padding vulnerability affects IBM HTTP Server shipped with IBM Presence Zones (CVE-2014-8730)

Summary IBM HTTP Server is shipped as a component of IBM Presence Zones. Information about a security vulnerability affecting IBM HTTP Server has been published in a security bulletin. Vulnerability Details Consult the TLS padding vulnerability affects IBM HTTP Server CVE-2014-8730 security...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Worklight (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by the optional FIPS 140-2 data-in-motion feature in IBM Worklight. IBM Worklight has addressed the applicable CVEs and included the SSL...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Worklight (CVE-2014-3509, CVE-2014-5139)

Summary There are multiple vulnerabilities in OpenSSL that is used by the optional FIPS 140-2 data-in-motion feature in IBM Worklight. These issues were disclosed on August 6, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-3509 DESCRIPTION: OpenSSL is vulnerable to a denial o...

Security Bulletin: Vulnerability in SSLv3 affects IBM Worklight (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Worklight. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: IBM Mobile Foundation, IBM Worklight, and IBM Worklight Foundation are affected by the following Apache Cordova vulnerabilities: CVE-2014-3500, CVE-2014-3501 and CVE-2014-3502

Summary Apache Cordova, which is used by these products, is vulnerable to Cross-Application Scripting XAS and Data Exfiltration vulnerabilities. A remote attacker might exploit these vulnerabilities to expose sensitive data from the mobile application. Vulnerability Details CVEID: CVE-2014-3500...

Security Bulletin: IBM Worklight and IBM Mobile Foundation application authenticity bypass (CVE-2014-0888)

Summary IBM Worklight and IBM Mobile Foundation application authenticity verification can be bypassed under certain conditions. Vulnerability Details CVEID: CVE-2014-0888 DESCRIPTION: The application authenticity feature in IBM Worklight and IBM Mobile Foundation enables the Worklight server to...

Security Bulletin: IBM Worklight is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL might allow a remote attacker to obtain sensitive information, which is caused by an error in the TLS/DTLS heartbeat functionality. An attacker might exploit this...

Security Bulletin: A security vulnerability has been identified in IBM Workload Deployer shipped with SmartCloud Orchestrator (CVE-2014-6158)

Summary IBM Workload Deployer is shipped as a component of IBM SmartCloud Orchestrator. Information about a security vulnerability affecting IBM Workload Deployer has been published in a security bulletin. Vulnerability Details Review security bulletin Security Bulletin: File path traversal...

Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer shipped with IBM SmartCloud Orchestrator (CVE-2014-6158)

Summary File path traversal vulnerabilities affect IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator CVE-2014-6158. Vulnerability Details Consult the Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer CVE-2014-6158 document for vulnerability...

Security Bulletin: IBM SmartCloud Orchestrator - Multiple security vulnerabilities exist in the IBM SDK, Java™ Technology Edition ( CVE-2014-4263, CVE-2014-4244)

Summary Multiple security vulnerabilities exist in the IBM SDK, Java™ Technology Edition, which is shipped with IBM SmartCloud Orchestrator. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and JRockit that is related to the Security component...

Security Bulletin: Log Viewer vulnerability affects IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator (CVE-2014-6190)

Summary Log Viewer vulnerability affects IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator CVE-2014-6190. Vulnerability Details For vulnerability details, see the IBM Workload Deployer Security Bulletin. Affected Products and Versions IBM SmartCloud Orchestrator 2.2 and 2.2...

Security Bulletin: Vulnerability in Keystone affects IBM SmartCloud Orchestrator (CVE-2014-3476)

Summary Vulnerability in Keystone affects IBM SmartCloud Orchestrator CVE-2014-3476. Vulnerability Details By creating a delegation from a trust or OAuth token, a trustee might abuse the identity impersonation against keystone and circumvent the enforced scope, which results in potential elevated...

Security Bulletin: Vulnerabilities in Django affect IBM SmartCloud Provisioning shipped with IBM SmartCloud Orchestrator (CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483).

Summary Vulnerabilities in Django affect IBM SmartCloud Provisioning, which is shipped with IBM SmartCloud Orchestrator CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483. Vulnerability Details Consult Vulnerabilities in Django affect SmartCloud Provisioning CVE 2014-0480, CVE 2014-0481,...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2, which shipped with IBM SmartCloud Orchestrator (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM SmartCloud Orchestrator. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details Review the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities CVE-2013-6747,...

Security Bulletin: SmartCloud Orchestrator - Multiple security vulnerabilities exist in the IBM SDK, Java™ Technology Edition (CVE-2013-5802, CVE-2013-5772, CVE-2014-0411)

Summary IBM SmartCloud Orchestrator is shipped with an IBM SDK that is based on Oracle JDK. Oracle released October 2013 and January 2014 critical patch updates CPU, which contain security vulnerability fixes. IBM SDK, Java™ Technology Edition, has been updated to include those fixes. The IBM SDK...

Security Bulletin: SmartCloud Orchestrator - Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition (CVE-2014-0453, CVE-2014-0460, CVE-2014-0878)

Summary Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition that is shipped with IBM SmartCloud Orchestrator. Vulnerability Details CVEID: CVE-2014-0453 DESCRIPTION: An unspecified vulnerability, which is related to the Security component, has partial confidentiality...

Security Bulletin: SmartCloud Orchestrator is affected by the following OpenSSL vulnerabilities (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, which is caused by the use of weak keying material in SSL/TLS...

Security Bulletin: IBM SmartCloud Orchestartor - Trustee token revocation does not work with memcache backend (CVE-2014-2237)

Summary When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This scenario results in the trust token not being invalidated by the trustee's token revocation bulk revocation. It is most noticeable...