Security Bulletin: Vulnerabilities in Rational Functional Tester versions 8.x due to security vulnerabilities in IBM JRE 7.0 Service Release 1 or earlier, and non-IBM Java 7.0

Vulnerability Details

Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information (requires login with your IBM ID)

CVE IDs: CVE-2012-4681, CVE-2012-0551, CVE-2012-0502, CVE-2012-1717, CVE-2012-1716, CVE-2012-1713, CVE-2012-1719, CVE-2012-1718, CVE-2012-1722, CVE-2012-1721, CVE-2012-1720, CVE-2012-1725, CVE-2012-1726

Description: Vulnerabilities exist in the following JREs that can impact the security of Rational Functional Tester:

1. IBM JRE 7.0 Service Release 1 or earlier that is shipped with Rational Functional Tester
2. Non-IBM Java 7.0 or earlier, when used with Rational Functional Tester

Fixes are available in IBM JRE 7.0 Service Release 2 (shipped with Rational Functional Tester version 8.3) and in the latest Java 7.0 patches.

CVEID: CVE 2012-4681

Remote attackers could execute arbitrary code through a crafted applet that bypasses SecurityManager restrictions, and access restricted classes or access and modify private fields.

CVSS Base Score 10

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/77972
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE 2012-0551
Remote attackers could affect confidentiality and integrity through unknown vectors related to Web Container or Deployment.

CVSS Base Score 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/75010
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVEID: CVE 2012-0502
Remote untrusted Java Web Start applications and untrusted Java applets could affect confidentiality and availability, related to AWT.

CVSS Base Score 6.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/73193
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVEID: CVE 2012-1726
Remote attackers could affect confidentiality and integrity through unknown vectors related to Libraries.

CVSS Base Score 6.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76246
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVEID: CVE 2012-1725
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Hotspot.

CVSS Base Score 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76243
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE 2012-1722
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Deployment. This vulnerability is different from CVE 2012-1721.

CVSS Base Score 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76241
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE 2012-1721
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Deployment. This vulnerability is different from CVE 2012-1722.

CVSS Base Score 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76240
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE 2012-1720
When running on Solaris, local users could affect confidentiality, integrity, and availability through unknown vectors related to Networking.

CVSS Base Score 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76250
CVSS Environmental Score undefined
CVSS Vector (AV:L/AC:H/Au:N/C:P/I:P/A:P)

CVEID: CVE 2012-1719
Remote attackers could affect integrity, related to CORBA.

CVSS Base Score 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76247
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVEID: CVE 2012-1718
Remote attackers could affect availability through unknown vectors related to Security.

CVSS Base Score 3.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76249
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE 2012-1717
Local users could affect confidentiality through unknown vectors related to printing on Solaris or Linux.

CVSS Base Score 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76251
CVSS Environmental Score undefined
CVSS Vector (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE 2012-1716
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Swing.

CVSS Base Score 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76244
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE 2012-1713
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to 2D.

CVSS Base Score 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/76239
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)