Security Bulletin: Rational Insight - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs

Summary Some security vulnerability exist in the OpenSSL library that is shipped with the Rational Report Server of the Rational Insight. Vulnerability Details Security vulnerabilities have been discovered and reported in the OpenSSL library. CVE-ID: CVE-2014-3513 DESCRIPTION: OpenSSL is vulnerab...

Security Bulletin: Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115)

Summary A security vulnerability exists in the Jazz Reporting Service JRS that is shipped with Rational Insight. Vulnerability Details Security vulnerabilities have been discovered and reported in Jazz Reporting Service. CVEID: CVE-2014-6115 Description: A Jazz Reporting Service JRS report URL ca...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affects Rational Directory Server (CVE-2014-6457, CVE-2014-6593)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 6 that is used by Rational Directory Server. These issues were disclosed as part of the IBM Java SDK updates in October 2014 and January 2015. Vulnerability Details CVEID: CVE-2014-6457...

Security Bulletin: Rational License Key Server Administration and Reporting Tool vulnerabilities (CVE-2014-3566, CVE-2014-4244)

Summary Two possible security vulnerabilities have been reported in RLKS Administration and Reporting Tool. There have been no reported exploits of these vulnerabilities. Vulnerability Details CVE ID: CVE-2014-3566 Description: Product could allow a remote attacker to obtain sensitive information...

Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004)

Summary The Castor Project Castor library is vulnerable affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE ID: CVE-2014-3004 Description: Castor Library could allow a remote attacker to obtain...

Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488)

Summary The Netty library is vulnerable affecting the Rational Integration Tester component in IBM Rational Test Workbench. Vulnerability Details CVE ID: CVE-2014-3488 Description: Netty is vulnerable to a denial of service, caused by an error in SslHandler. A remote attacker could exploit this...

Security Bulletin: TLS padding vulnerability affects IBM Rational RequisitePro (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Rational RequisitePro. Vulnerability Details CVE-ID: CVE-2014-8730 Description: IBM Rational RequisitePro could allow a remote attacker to obtain sensitiv...

Security Bulletin: Rational Insight - IBM SDK, Java Technology Edition Quarterly CPU - July 2014 (CVE-2014-4263)

Summary A security vulnerability exists in the IBM JRE that is shipped with Rational Insight. Vulnerability Details Security vulnerabilities have been discovered and reported in IBM SDK, Java Technology Edition Quarterly CPU - July 2014 update. CVEID: CVE-2014-4263 Description: An unspecified...

Security Bulletin: Cross-Site Scripting vulnerability in IBM Rational Quality Manager (CVE-2014-4801)

Summary IBM Quality Manager has a cross-site scripting vulnerability. Vulnerability Details CVEID: CVE-2014-4801 Description: IBM Rational Quality Manager is vulnerable to cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerabilit...

Security Bulletin: Vulnerability in SSLv3 affects IBM Rational RequisitePro (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational RequisitePro. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this...

Security Bulletin: Rational RequisitePro affected by Java vulnerabilities (CVE-2014-4244, CVE-2014-4263)

Summary This bulletin covers remediation measures for the CVEs published in Oracle's July 2014 CPU that affect Rational RequisitePro. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires...

Security Bulletin: Rational RequisitePro affected by OpenSSL vulnerabilities: (CVE-2014-5139, CVE-2014-3509, CVE-2014-3511)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on August 7, 2014 by the OpenSSL Project. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login wi...

Security Bulletin: Security vulnerability in Apache Commons File Upload affects IBM Rational Quality Manager (CVE-2014-0050)

Summary IBM Rational Quality Manage ships with the Apache Commons File Upload library which contains a security vulnerability that could potentially be exploited to cause a denial of service attack. Vulnerability Details | Subscribe to My Notifications to be notified of important product support...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Build Forge (CVE-2014-6457)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 1.5, 1.6, 1.7 that is used by IBM Rational Build Forge. These issues were disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVEID: CVE-2014-6457 Description: An unspecified...

Security Bulletin: Java Technology Edition Quarterly CPU - October 2014 for Rational Automation Framework (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLTLS is enabled by default in embedded Build Forge in some pages. Vulnerability Details | Subscribe to My Notifications to be notified of important product suppo...

Security Bulletin: Rational Automation Framework Security Advisory (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLTLS is enabled by default in embedded Build Forge in some pages. Vulnerability Details | Subscribe to My Notifications to be notified of important product suppo...

Security Bulletin: Rational Application Developer for WebSphere Software in Cordova platform (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL support for SSL 3.0 fallback protection + other 3 CVEs that affect the IBM SDK for Node.js used by the Cordova platform packaged with IBM Rational Application Developer for WebSphere Software. Vulnerability Details | Subscribe to My Notifications to be notified of important produc...

Security Bulletin: Vulnerability in SSLv3 affects Rational Tau (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Rational Tau Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in SSLv3 affects Rational BuildForge (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLTLS is enabled by default in Build Forge in some pages. Vulnerability Details CVE ID: CVE-2014-3566 Description: IBM WebSphere Application could allow a remote...

Security Bulletin: Vulnerability in SSLv3 affects Rational Insight (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Rational Insight. Vulnerability Details CVE-ID: CVE-2014-3566 Description: Product could allow a remote attacker to obtain sensitive informatio...