Flashes (Alerts)
Abstract
Smarter Infrastructure Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs.
Content
VULNERABILITY DETAILS:
Customers who have Java based applications, such as Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions (including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities), Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, Change and Configuration Management Database, SmartCloud Control Desk, Intelligent Building Management, or TRIRIGA for Energy Optimization are potentially impacted by these vulnerabilities, which can cause issues related to confidentiality, integrity, and availability. For additional information including the most current description and CVSS for each vulnerability, please refer to developerWorks JavaTM Technology Security Alerts.
CVE ID | DESCRIPTION |
CVE-2013-1500 CVSS Base Score: 3.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85062 CVSS Environmental Score*: Undefined CVSS Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N | Unspecified vulnerability in the JRE component allows local users to affect confidentiality and integrity via unknown vectors related to 2D |
CVE-2013-1571 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/82822 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Javadoc |
CVE-2013-2400 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85050 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
CVE-2013-2407 CVSS Base Score: 6.4 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85044 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries |
CVE-2013-2412 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85059 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Serviceability |
CVE-2013-2437 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85049 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Deployment |
CVE-2013-2442 CVSS Base Score: 7.5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85041 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
CVE-2013-2443 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85054 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
CVE-2013-2444 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85047 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to AWT |
CVE-2013-2445 CVSS Base Score: 7.8 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85039 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via unknown vectors related to Hotspot |
CVE-2013-2446 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85048 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via vectors related to CORBA |
CVE-2013-2447 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85056 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Networking |
CVE-2013-2448 CVSS Base Score: 7.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85040 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound |
CVE-2013-2449 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85060 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
CVE-2013-2450 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85057 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P | Unspecified vulnerability in the JRE component allows remote attackers to affect availability via unknown vectors related to Serialization |
CVE-2013-2451 CVSS Base Score: 3.7 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85061 CVSS Environmental Score*: Undefined CVSS Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P | Unspecified vulnerability in the JRE component allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking |
CVE-2013-2452 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85055 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
CVE-2013-2453 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85053 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to JMX |
CVE-2013-2454 CVSS Base Score: 5.8 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85045 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via vectors related to JDBC |
CVE-2013-2455 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/84146 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Libraries |
CVE-2013-2456 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85058 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality via unknown vectors related to Serialization |
CVE-2013-2457 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85052 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via vectors related to JMX |
CVE-2013-2458 CVSS Base Score: 5.8 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85046 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries |
CVE-2013-2459 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85033 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT |
CVE-2013-2460 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85038 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability |
CVE-2013-2461 CVSS Base Score: 7.5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85042 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries |
CVE-2013-2462 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85037 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
CVE-2013-2463 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85029 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2464 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85030 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2465 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85031 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2466 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85035 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
CVE-2013-2467 CVSS Base Score: 6.9 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85043 CVSS Environmental Score*: Undefined CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Java installer |
CVE-2013-2468 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85034 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment |
CVE-2013-2469 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85032 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2470 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85025 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2471 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85026 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2472 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85027 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-2473 CVSS Base Score: 10 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85028 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D |
CVE-2013-3743 CVSS Base Score: 9.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85036 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C | Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT |
CVE-2013-3744 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85051 CVSS Environmental Score*: Undefined CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N | Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Deployment |
The developerWorks JavaTM Technology Security Alerts includes a link to Oracle's June 2013 Critical Patch Update.
AFFECTED PRODUCTS:
The following Oracle Java versions, which are not IBM products, are affected:
· Java SE JDK and JRE Version 7 Update 7 and earlier***
· Java SE JDK and JRE Version 6 Update 35 and earlier
· Java SEJDK and JRE Version 5 Update 36 and earlier
· Java SE JDK and JRE Version 1.4.2_38 and earlier
The following IBM Java versions are affected:
· IBM SDK Java Technology Edition Version 7***
· IBM SDK Java Technology Edition Version 6
· IBM SDK Java Technology Edition Version 5
· IBM SDK Java Technology Edition Version 1.4.2
IBM supplied the Java Runtime Environment (JRE) from the IBM SDK Java Technology Edition Versions with the following:
The 6.x versions of Maximo Asset Management, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, Tivoli Asset Management for IT, and Maximo Service Desk bundled the JRE from IBM SDK Java Technology Edition Version 1.4.2.
The 7.1.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.
The 7.2.x versions of Tivoli Asset Management for IT, Tivoli Service Request Manager, and Tivoli Change and Configuration Management Database bundled the JRE from IBM SDK Java Technology Edition Version 5.
The 7.5.x versions of Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, Maximo for Utilities, and SmartCloud Control Desk bundled the JRE from IBM SDK Java Technology Edition Version 6.
Intelligent Building Management 1.1.x and TRIRIGA for Energy Optimization 1.1.x bundled the JRE from IBM SDK Java Technology Edition Version 6.
It is likely that earlier versions of affected products are also affected by these vulnerabilities. Remediation is not provided for product versions that are no longer supported. IBM recommends that customers upgrade to the latest supported version of products in order to obtain remediation for the vulnerabilities.
***Please note that the versions of the IBM products listed above do not bundle JRE Version 7 or IBM SDK Java Technology Edition Version 7; however, JRE Version 7 and IBM SDK Java Technology Edition Version 7 are listed here because JRE Version 7 is relatively prevalent on the browser and therefore can potentially impact access to these IBM product versions.
REMEDIATION:
VENDOR FIXES:
There are two areas where the vulnerabilities in the Java SDK/JDK or JRE may require remediation:
1. Application Server – Update the Websphere Application Server. Refer to JDK Fixes for Websphere Application Server for additional information on updating and maintaining the JDK component within Websphere. Customers with Oracle Weblogic Server, which is not an IBM product and is not shipped by IBM, will also want to update their server.
2. Browser Client - Update the Java plug-in used by the browser on client systems, using the remediated JRE version referenced on developerWorks JavaTM Technology Security Alerts or referenced on Oracle’s latest Critical Patch Update (which can be accessed via developerWorks JavaTM Technology Security Alerts). Updating the browser Java plug-in may impact some applets such as Maximo Asset Management Scheduler. Download from IBM FixCentral the latest Maximo Asset Management Scheduler Interim Fix for Version 7.1 or the latest Maximo Asset Management Fix Pack for Version 7.5, which includes the resolution for APAR IV11560.
Due to the threat posed by a successful attack, IBM strongly recommends that customers apply fixes as soon as possible.
WORKAROUNDS AND MITIGATIONS:
Until you apply the fixes, it may be possible to reduce the risk of successful attack by restricting network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from unprivileged users may help reduce the risk of successful attack. Both approaches may break application functionality, so IBM strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.
REFERENCES:
Complete CVSS Guide
On-line Calculator V2
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.
Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
RELATED INFORMATION:
ACKNOWLEDGEMENTS:
None
Change History | |
26 Aug 2013 | Flash published |
CROSS REFERENCE INFORMATION:
Segment | Product | Component/Platform | Version |
Systems and Asset Management | Maximo Asset Management | All | 6.2.0 – 6.2.8 7.1.1.0 – 7.1.1.11 7.5.0.0 – 7.5.0.4 |
Systems and Asset Management | Maximo Asset Management Essentials | All | 7.1.1.0 – 7.1.1.10 7.5.0.0 – 7.5.0.4 |
Systems and Asset Management | Maximo Asset Management for Energy Optimization | All | 7.1.0.0 – 7.1.1.0 |
Systems and Asset Management | Maximo for Government | All | 6.1.0.0 7.1.0.0 7.5.0.0 |
Systems and Asset Management | Maximo for Nuclear Power | All | 6.3.0 7.1.0.0 – 7.1.1.0 7.5.0.0 – 7.5.1.0 |
Systems and Asset Management | Maximo for Transportation | All | 6.3.0 7.1.0.0 – 7.1.1.0 7.5.0.0 |
Systems and Asset Management | Maximo for Life Sciences | All | 6.4.0 – 6.5.0 7.1.0.0 – 7.1.2.0 7.5.0.0 |
Systems and Asset Management | Maximo for Oil and Gas | All | 6.3.0 – 6.4.0 7.1.0.0 – 7.1.2.0 7.5.0.0 – 7.5.1.0 |
Systems and Asset Management | Maximo for Utilities | All | 6.3.0 7.1.0.0 – 7.1.2.0 7.5.0.0 |
Systems and Asset Management | Tivoli Service Request Manager Maximo Service Desk | All | 7.1.0.0 – 7.1.1.11 7.2.0.0 – 7.2.1.3 6.2.0 – 6.2.8 |
Systems and Asset Management | Tivoli Asset Management for IT | All | 6.2.0 – 6.2.8 7.1.0.0 – 7.1.1.11 7.2.0.0 – 7.2.2.1 |
Systems and Asset Management | Change and Configuration Management Database | All | 7.1.0.0 – 7.1.1.11 7.2.0.0 – 7.2.1.2 |
Systems and Asset Management | Intelligent Building Management | All | 1.1.0.0 |
Systems and Asset Management | TRIRIGA for Energy Optimization | All | 1.1.0.0 |
Systems and Asset Management | SmartCloud Control Desk | All | 7.5.0.0 – 7.5.1.0 |
Was this topic helpful?
Document Information
Modified date:
25 September 2022
UID
swg21648074