Security Bulletin: Potential Security Vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8

Vulnerability Details

CVE ID: CVE-2013-0460 (PM72275)

DESCRIPTION: WebSphere Application Server could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in the administrative console. By persuading a user to visit a malicious Web site, a remote attacker could exploit this vulnerability to obtain sensitive information.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81014 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8.0

Version 7

Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM72275, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.25:

Apply Fix Pack 27 (7.0.0.27), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

Workaround(s): None
Mitigation(s): none


CVE ID: CVE-2013-4053 (PM90949 and PM91521)

DESCRIPTION: WebSphere Application Server using WS-Security and configured for XML Digital Signature using trust store, could allow a network attacker to gain elevated privileges on the system, caused by improper checking of the certificate.

CVSS:

CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86505 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF for WebSphere Application Server as noted below:

For IBM WebSphere Application Server (PM90949)

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

OR

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM90949

Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then

Apply the APAR Interim Fix

For IBM WebSphere Application Server Feature Pack for Web Services (PM91521)

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

OR

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM91521

Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then

Apply the APAR Interim Fix

Workaround(s): None
Mitigation(s): none


CVE ID: CVE-2013-4052 (PM91892)

DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the UDDI Administrative console. A network attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim's Web browser within the security context of the hosting Web site.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86504 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM91892, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

Workaround(s): None
Mitigation(s): none


CVE ID: CVE-2013-5414 (PM92313)

DESCRIPTION: WebSphere Application Server could allow existing users to gain elevated privileges on the system caused by incorrect Administration Security roles being assigned after migration from version 6.1 or later.

NOTE: If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with "adminsecmanager" (Administrative Security Manager) role need to be evaluated to determine if they should have both "admin" role and "adminsecmanager" role. Some users may not need both designations and the privileges should be removed accordingly.

CVSS:

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87476 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM92313, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

Workaround(s): If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with "adminsecmanager" role need to be evaluated to determine if they should have both "admin" role and "adminsecmanager" (Administrative Security Manager) role. Some users may not need both designations and the privileges should be removed accordingly.
Mitigation(s): none


CVE ID: CVE-2013-5417 (PM93323 and PM93944)

DESCRIPTION: WebSphere Application Server could be vulnerable to cross-site scripting, caused by improper validation of application HTTP response data.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87479 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing APAR PM93323 for IBM WebSphere Application Server Full Profile or APAR PM93944 for IBM WebSphere Application Server Liberty Profile, as noted below:

For IBM WebSphere Application Server Full Profile

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For IBM WebSphere Application Server Liberty Profile

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

Workaround(s): None
Mitigation(s): none


CVE ID: CVE-2013-5418 (PM96477)

DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the Administrative console. A remote attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim's Web browser within the security context of the hosting Web site.

CVSS:

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87480 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM96477, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

Workaround(s): None
Mitigation(s): none

CVE ID: CVE-2013-6725 (PM98132)

DESCRIPTION: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused by improper validation of input in the Administrative Console. A remote attacker with Administrative authority could exploit this vulnerability using a specially-crafted URL to inject script into a victim's Web browser within the security context of the hosting Web site.

CVSS:

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89280 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM98132, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.1:

Apply Fix Pack 2 (8.5.5.2), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

Workaround(s): None
Mitigation(s): none


CVE ID: CVE-2013-6325 (PM99450)

DESCRIPTION: IBM WebSphere Application Server could be vulnerable to a denial of service, caused by improper handling of requests by a web services endpoint. By passing a specially-crafted request, a remote attacker could exploit this vulnerability to consume available resources.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/88906 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5

Version 8

Version 7

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM99450, as noted below:

For IBM WebSphere Application Server

For V8.5 through 8.5.5.1:

Apply Fix Pack 1 (8.5.5.2), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

Workaround(s): None
Mitigation(s): none


IBM SDK: Please refer to this security bulletin for SDK fixes that were shipped with WebSphere Application Server Version 7.0.0.31
http://www.ibm.com/support/docview.wss?&uid=swg21655990