Security Bulletin: Multiple Vulnerabilities in Rational Synergy

CVE ID : CVE-2012-0551 (CVSS 5.8)

DESCRIPTION : Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/75010 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVE ID : CVE-2012-1717 (CVSS 3.5)

DESCRIPTION : Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.

CVSS:
CVSS Base Score: 2.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76251 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVE ID : CVE-2012-1716 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76244 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1713 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76239 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1718 (CVSS 3.6)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect availability via unknown vectors related to Security.

CVSS:
CVSS Base Score: 5.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76249 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE ID : CVE-2012-1719 (CVSS 5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect integrity, related to CORBA.

CVSS:
CVSS Base Score: 5.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/76247 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE ID : CVE-2012-1722 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1721.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See (http://xforce.iss.net/xforce/xfdb/76241 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1721 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See (http://xforce.iss.net/xforce/xfdb/76240 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1725 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See (http://xforce.iss.net/xforce/xfdb/76243 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1531 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79294 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1532 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/26069 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-1533 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/26069 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-3143 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability, related to JMX.

CVSS:
CVSS Base Score: 10.0
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE ID : CVE-2012-3159 (CVSS 7.5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS:
CVSS Base Score: 7.5
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE ID : CVE-2012-3216 (CVSS 2.6)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

CVSS:
CVSS Base Score: 2.6
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:H/Au:N/C:P/I:N/A:N)

CVE ID : CVE-2012-4416 (CVSS 6.4)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 updates 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.

CVSS:
CVSS Base Score: 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/78432 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVE ID : CVE-2012- 5068 (CVSS 7.5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS:
CVSS Base Score: 7.5
CVSS Temporal Score: See (http://xforce.iss.net/xforce/xfdb/79293 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE ID : CVE-2012- 5069 (CVSS 5.8)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Concurrency.

CVSS:
CVSS Base Score: 5.8
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVE ID : CVE-2012- 5071 (CVSS 6.4)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality and integrity, related to JMX.

CVSS:
CVSS Base Score: 6.4
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVE ID : CVE-2012- 5072 (CVSS 5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Security.

CVSS:
CVSS Base Score: 5.0
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE ID : CVE-2012- 5073 (CVSS 5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS:
CVSS Base Score: 5.0
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE ID : CVE-2012- 5075 (CVSS 5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) 6 update 35 and earlier, allows remote attackers to affect confidentiality, related to JMX.

CVSS:
CVSS Base Score: 5.0
CVSS Temporal Score: Unknown
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

References:
Complete CVSS Guide(http://www.first.org/cvss/cvss-guide.html)

Affected Platforms: All Rational Synergy supported platforms

Remediation: Rational Synergy 7.1.0.X users should move to Rational Synergy version 7.1.0.7 (Rational Synergy 7.1.0.7)

Workarounds: None known; apply fixes

Mitigation: Must upgrade to the new Rational Synergy releases as recommended.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.