Security Bulletin: Vulnerabilities in Rational Functional Tester versions 8.x due to security vulnerabilities in IBM JRE 7.0 Service Release 1 or earlier, and non-IBM Java 7.0

Flash (Alert)


Abstract

Multiple security vulnerabilities exist in the Java Runtime Environments (JREs) IBM JRE 7.0 Service Release 1 or earlier, and non-IBM Java 7.0 or earlier, that can affect the security of Rational Functional Tester. Fixes are available in IBM JRE 7.0 Service Release 2 and in the latest Java 7.0 patches.

Content

VULNERABILITY DETAILS

CVE IDs: CVE-2012-4681, CVE-2012-0551, CVE-2012-0502, CVE-2012-1717, CVE-2012-1716, CVE-2012-1713, CVE-2012-1719, CVE-2012-1718, CVE-2012-1722, CVE-2012-1721, CVE-2012-1720, CVE-2012-1725, CVE-2012-1726

DESCRIPTION:
Vulnerabilities exist in the following JREs that can impact the security of Rational Functional Tester:
1) IBM JRE 7.0 Service Release 1 or earlier that is shipped with Rational Functional Tester
2) Non-IBM Java 7.0 or earlier, when used with Rational Functional Tester
Fixes are available in IBM JRE 7.0 Service Release 2 (shipped with Rational Functional Tester version 8.3) and in the latest Java 7.0 patches.

CVEID: CVE 2012-4681
Remote attackers could execute arbitrary code through a crafted applet that bypasses SecurityManager restrictions, and access restricted classes or access and modify private fields.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/77972
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE 2012-0551
Remote attackers could affect confidentiality and integrity through unknown vectors related to Web Container or Deployment.

CVSS Base Score 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/75010
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:M/Au:N/C:P/I:P/A:N)


CVEID: CVE 2012-0502
Remote untrusted Java Web Start applications and untrusted Java applets could affect confidentiality and availability, related to AWT.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/73193
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:P)


CVEID: CVE 2012-1726
Remote attackers could affect confidentiality and integrity through unknown vectors related to Libraries.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76246
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:P/A:N)


CVEID: CVE 2012-1725
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Hotspot.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76243
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE 2012-1722
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Deployment. This vulnerability is different from CVE 2012-1721.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76241
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE 2012-1721
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Deployment. This vulnerability is different from CVE 2012-1722.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76240
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE 2012-1720
When running on Solaris, local users could affect confidentiality, integrity, and availability through unknown vectors related to Networking.

CVSS Base Score 3.7
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76250
CVSS Environmental Score undefined
CVSS Vector (AV:L/AC:H/Au:N/C:P/I:P/A:P)


CVEID: CVE 2012-1719
Remote attackers could affect integrity, related to CORBA.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76247
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:P/A:N)


CVEID: CVE 2012-1718
Remote attackers could affect availability through unknown vectors related to Security.

CVSS Base Score 3.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76249
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:N/A:P)


CVEID: CVE 2012-1717
Local users could affect confidentiality through unknown vectors related to printing on Solaris or Linux.

CVSS Base Score 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76251
CVSS Environmental Score undefined
CVSS Vector (AV:L/AC:L/Au:N/C:P/I:N/A:N)


CVEID: CVE 2012-1716
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Swing.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76244
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE 2012-1713
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to 2D.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76239
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C
)

REFERENCES:

  • Complete CVSS guide: http://www.first.org/cvss/cvss-guide.html
    *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.
  • X-Force Vulnerability Database: http://xforce.iss.net/

AFFECTED PLATFORMS:

  • IBM JRE 7.0 Service Release 1 or earlier, shipped with Rational Functional Tester
  • non-IBM Java 7.0


REMEDIATION:
IBM Rational Functional Tester 8.3 ships with IBM Java 7.0 Service Release 2 which addresses these security issues. If you are using a version of Rational Functional Tester earlier than 8.3, upgrade to version 8.3.

If you intend to use IBM Rational Functional Tester with a non-IBM Java 7.0, ensure that you upgrade to the latest Java 7.0 patches to fix the vulnerability security issues.

MITIGATION:
None found. Apply fixes.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Product Alias/Synonym

RFT

Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Rational Functional Tester

Software version:

8.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.1, 8.1.0.1, 8.1.0.2, 8.1.0.3, 8.1.1, 8.1.1.1, 8.1.1.2, 8.1.1.3, 8.2, 8.2.0.1, 8.2.0.2, 8.2.1, 8.2.1.1, 8.2.2, 8.2.2.1, 8.3

Operating system(s):

Linux, Windows

Reference #:

1614347

Modified date:

2012-11-13

Translate my page

Machine Translation

Content navigation