Security bulletin: Open redirect and cross-site scripting vulnerabilities in IBM DataQuant for z/OS and IBM DataQuant for Multiplatforms help systems (CVE-2012-2159, CVE-2012-2161)

Abstract IBM DataQuant for z/OS and IBM DataQuant for Multiplatforms make use of the IBM Eclipse Help System IEHS, which has the security vulnerabilities described in this bulletin. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-2159 DESCRIPTION: Some scripts used by the help system are vulnerab...

Security Bulletin: Potential security exposure when using IBM InfoSphere Streams due to vulnerabilities in IBM Java SE Version 6 SDK.

Abstract IBM InfoSphere Streams makes use of IBM Java SE Version Version 6 SDK. Potential security exposures exist in IBM InfoSphere Streams due to vulnerabilities in IBM Java SE Version 6 SDK. Content VULNERABILITYDETAILS: CVE-2012-1718, CVE-2012-3143, CVE-2012-3159, CVE-2012-5081 DESCRIPTION:...

Security Bulletin: Tivoli Federated Identity Manager Business Gateway - Unprotected Management Console Servlets (CVE-2012-3315)

Abstract SUMMARY The management console used to administer Tivoli Federated Identity Manager Business Gateway contains servlets which are not all protected via a J2EE security constraint. These servlets could be used by an unauthenticated user to download certain resources from TFIMBG. Content...

Security bulletin: Open redirect and cross-site scripting vulnerabilities in DB2 QMF for Workstation and DB2 QMF for WebSphere help systems (CVE-2012-2159, CVE-2012-2161)

Abstract IBM DB2 QMF for Workstation and IBM DB2 QMF for WebSphere make use of the IBM Eclipse Help System IEHS, which has the security vulnerabilities described in this bulletin. Content VULNERABILITY DETAILS: A brief description of each vulnerability is provided below. IBM does not intend to...

Security Bulletin: IBM Informix Dynamic Server SET COLLATION vulnerability (CVE-2012-3334).

Abstract A stack-based buffer overflow in IBM Informix Dynamic Server 11.50 and 11.70 could allow code execution. Content VULNERABILITY DETAILS The specific flaw exists when processing the arguments to the SET COLLATION statement. Exploitation can result in arbitrary code execution with the...

Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine (CVE-2012-4818)

Abstract Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine CVE-2012-4818 Content VULNERABILITY DETAILS: CVE ID: CVE-2012-4818 DESCRIPTION: Whenever an Information Server client application such as InfoSphere DataStage and QualitySta...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions affected by multiple vulnerabilities in GSKit (CVE-2012-2203, CVE-2012-2191, CVE-2012-2190)

Abstract Vulnerabilities in IBM Global Security Kit GSKit, shipped as part of IBM Tivoli Composite Application Manager for Transactions ITCAM for Transactions. Content VULNERABILITY DETAILS: Security vulnerabilities have been discovered in the GSKit libraries. ITCAM for Transactions uses the GSKi...

Security Bulletin: Vulnerabilities in IBM Java SDK (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed under a security manager e.g. Java applets running in a web browser. Content VULNERABILITY DETAILS: CVE IDs: CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823 DESCRIPTION: There ar...

Security Bulletin: Tivoli Federated Identity Manager - Passwords exposed in trace files (CVE-2012-3310)

Abstract SUMMARY It is possible to configure Tivoli Federated Identity Manager TFIM in such a way that the logging of certain activities could result in the trace files produced by TFIM containing passwords that are either in clear text or obfuscated in a manner that the password can be derived...

Security Bulletin: Unauthorized File Access Security Vulnerability in DB2 XML Feature (CVE-2012-0713)

Abstract Vulnerability in IBM DB2 XML Feature could allow a remote attacker to view XML files owned by the DB2 instance owner. Content VULNERABILITY DETAILS CVE ID: CVE-2012-0713 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability in the DB2 XML Feature which could all...

Security Bulletin: Unspecified vulnerability in InfoSphere Guardium allows remote unauthenticated attackers to create unprivileged user accounts (CVE-2012-3338)

Abstract Unspecified vulnerability in InfoSphere Guardium allows remote unauthenticated attackers to create unprivileged user accounts. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3338 DESCRIPTION: There is a way for an attacker to login to the InfoSphere Guardium User Interface with the know...

Security Bulletin: IBM Tivoli Directory Server Cross-Site scripting vulnerability with the Web Admin Tool (CVE-2012-0740)

Abstract IBM Tivoli Directory Server is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Web Admin Tool. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0740 DESCRIPTION: IBM Tivoli Directory Server TDS is vulnerable to cross-site scripting, caused b...

Security Bulletin: XML External Entity (XXE) security vulnerability in InfoSphere Guardium (CVE-2012-3339)

Abstract XML External Entity XXE security vulnerability in InfoSphere Guardium allows remote authenticated users to obtain sensitive information via unspecified vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3339 DESCRIPTION: User can get to an error report containing content of a file ...

Security Bulletin: Denial of Service Security Vulnerability in DB2’s XML Feature. (CVE-2012-0712)

Abstract Vulnerability in IBM DB2’s XML Feature could allow a remote attacker to cause the database server to crash. Content VULNERABILITY DETAILS CVE ID: CVE-2012-0712 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability in DB2’s XML Feature which could allow a malicio...

Security Bulletin: IBM Tivoli Directory Server use of NULL ciphers in default Transport Layer Security configuration would result in unencrypted communications (CVE-2012-0726)

Abstract IBM Tivoli Directory Server TDS enables NULL-MD5 and NULL-SHA ciphers in the default Transport Layer Security TLS configuration. Use of either of these ciphers would result in unencrypted communications. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0726 DESCRIPTION: In the default TDS...

Security Bulletin: XML External Entity (XXE) security vulnerability in InfoSphere Guardium (CVE-2012-3340)

Abstract XML External Entity XXE security vulnerability in InfoSphere Guardium allows remote authenticated users to obtain sensitive information via unspecified vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3340 DESCRIPTION: User can get to an error report containing content of a file ...

Security Bulletin: IBM Tivoli Directory Server paged search may cause denial of service may crash if paged searches are enabled (CVE-2012-0743)

Abstract A custom LDAP client can be created which would cause IBM Tivoli Directory Server to crash by sending a malformed paged search request. This can cause a denial of service. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0743 DESCRIPTION: A custom LDAP client can be created which would...

Security Bulletin: IBM DB2 Security Vulnerability in the UTL_FILE module (CVE-2012-3324).

Abstract Vulnerability in IBM DB2 could allow an authenticated user, without proper authorization, to view, modify and delete any file. Content VULNERABILITY DETAILS CVE ID: CVE-2012-3324 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allow an...

Security Bulletin: GSKit SSL/TLS Record Length vulnerability in Tivoli Directory Server (CVE-2012-2191)

Abstract A vulnerability has been identified in the GSKit component utilized by Tivoli Directory Server TDS. A specifically crafted malformed SSL/TLS data packet can cause the TDS server using GSKit to segmentation fault.. Remediation for the issue consists of updating GSKit 7 to version 7.0.4.41...

Security Bulletin: TADDM uses weak SSL certificates (CVE-2012-5770)

Abstract IBM Tivoli Application Dependency Discovery Manager SSL certificate uses weak MD5 hash algorithm Content VULNERABILITY DETAILS: DESCRIPTION: TADDM uses weak certificates for SSL communication what can lead to man in the middle attack. The attacker must have access to traffic between TADD...