Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Tivoli Monitoring. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-3514 DESCRIPTION: An unspecified vulnerabilit...

Security Bulletin: IBM Tivoli Monitoring Agent Framework component. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9843)

Summary IBM Tivoli Monitoring uses zlib compression library in both the General services library and the File Transfer component. This bulletin address several reported vulnerabilities in the zlib compression library. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server

Summary The following security issues have been identified in WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID: CVE-2017-1121 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerabilit...

Security Bulletin: IBM Tivoli Monitoring TEP Server vulnerabilities

Summary By default, communications between the Tivoli Enterprise Portal client and server are not encrypted which can cause the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-1181 DESCRIPTION: IBM Tivoli Monitoring Portal client could allow a local attacker to gain elevated...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

Summary There are several vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID: CVE-2017-3289 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Hotsp...

Security Bulletin: A security vulnerability has been identified in IBM Tivoli Monitoring shipped with Tivoli Business Service Manager (CVE-2016-2183)

Summary IBM Tivoli Monitoring via the monitoring agent is shipped as a component of Tivoli Business Service Manager. Information about a security vulnerability affecting IBM Tivoli Monitoring has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: IB...

Security Bulletin: IBM Tivoli Monitoring Basic Services component. (CVE-2016-2183)

Summary Vulnerability in GSKit component of IBM Tivoli Monitoring has been addressed. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. B...

Security Bulletin: IBM Tivoli Monitoring Soap Server (CVE-2016-6083)

Summary The default configuration for IBM Tivoli Monitoring soap interface allows unathenticated users access to soap requests. Vulnerability Details CVEID: CVE-2016-6083 DESCRIPTION: IBM Tivoli Monitoring could disclose could allow an unauthenticated user to access SOAP queries that could contai...

Security Bulletin: A vulnerability in the SQLite component of the Response Time agent affects IBM Performance Management products (CVE-2016-6153)

Summary SQLite could allow a local attacker to gain elevated privileges on the system, caused by the creation of temporary files in directory with insecure permissions. An attacker could exploit this vulnerability to obtain leaked data. Vulnerability Details CVEID: CVE-2016-6153 DESCRIPTION: SQLi...

Security Bulletin: A vulnerability in the GSKIT component of the Core Framework affects IBM Performance Management products (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: Multiple vulnerabilities in zlib affect IBM Tivoli Composite Application Manager for Transactions (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary There are multiple vulnerabilities in zlib that is used by IBM Tivoli Composite Application Manager for Transactions. Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic ...

Security Bulletin: A vulnerability in the Apache Xerces-C XML Parser library affects IBM Performance Management products (CVE-2016-4463)

Summary The Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing a deeply nested DTD. A remote attacker could exploit this vulnerability to cause a denial of service. Vulnerability Details CVEID: CVE-2016-4463 DESCRIPTION:...

Security Bulletin: IBM Tivoli Monitoring Basic Services component. (CVE-2012-6702, CVE-2016-5300)

Summary IBM Tivoli Monitoring uses Expat parser for parsing various configuration xml files as well as parsing soap requests. Vulnerability Details CVEID: CVE-2012-6702 DESCRIPTION: Expat, when used in a parser that has not called XMLSetHashSalt or passed it a seed of 0, could provide weaker than...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server

Summary The following security issues have been identified in WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID: CVE-2016-5573 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Hotspo...

Security Bulletin: IBM Tivoli Monitoring affected by vulnerabilities in IBM® SDK, Java™ Technology Edition

Summary The vulnerabilities listed below have been identified in the IBM® SDK, Java™ Technology Edition Java Runtime Environment JRE which is installed into the IBM Tivoli Monitoring installation directory for example, CANDLEHOME. This is an embedded JRE is used by various IBM Tivoli Monitoring...

Security Bulletin: IBM Tivoli Monitoring Basic Services Vulnerability (CVE-2016-5933)

Summary A vulnerability has been resolved in the Basic Services component of IBM Tivoli Monitoring in which the Firewall Proxy Gateway was vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. Vulnerability Details CVEID: CVE-2016-5933...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

Summary There are several vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID: CVE-2016-5568 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the AWT component has high...

Security Bulletin: A vulnerability in the GSKit component of IBM Tivoli Monitoring (CVE-2015-1788)

Summary A vulnerability has been addressed in the GSKit component of IBM Tivoli Monitoring ITM. IBM Tivoli Monitoring also utilizes the IBM HTTP Server IHS as the default HTTP server for the portal server. IBM HTTP Server is also affected by the CVE as listed below. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in TLS affects IBM Tivoli Monitoring (CVE-2014-8730 )

Summary A new variant of the Padding Oracle On Downgraded Legacy Encryption POODLE attack for TLS may affect IBM Tivoli Monitoring ITM. Vulnerability Details CVEID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by the failure to check the...

Security Bulletin: Vulnerability in SSLv3 affects IBM Tivoli Monitoring (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Tivoli Monitoring ITM. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...