Security Bulletin: Vulnerabilities in Rational Functional Tester versions 8.x due to security vulnerabilities in IBM JRE 7.0 Service Release 2 or earlier, and non-IBM Java 7.0

Flash (Alert)


Abstract

Multiple security vulnerabilities exist in the Java Runtime Environments (JREs) IBM JRE 7.0 Service Release 1 or earlier, and non-IBM Java 7.0 or earlier, that can affect the security of Rational Functional Tester. Fixes are available in IBM JRE 7.0 Service Release 3 and in the latest Java 7.0 patches.

Content

VULNERABILITY DETAILS

CVE IDs: CVE-2012-3159, CVE-2012-3216, CVE-2012-5070, CVE-2012-5067, CVE-2012-3143, CVE-2012-5076, CVE-2012-5077, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-1532, CVE-2012-1533, CVE-2012-5069, CVE-2012-5071, CVE-2012-5084, CVE-2012-5087, CVE-2012-5086, CVE-2012-5079, CVE-2012-5088, CVE-2012-5089

DESCRIPTION:
Vulnerabilities exist in the following JREs that can impact the security of Rational Functional Tester:
1) IBM JRE 7.0 Service Release 2 or earlier that is shipped with Rational Functional Tester
2) Non-IBM Java 7.0 or earlier, when used with Rational Functional Tester
Fixes are available in IBM JRE 7.0 Service Release 3 (shipped with Rational Functional Tester version 8.3.0.1) and in the latest Java 7.0 patches.

CVEID: CVE-2012-3159
Remote attackers could affect confidentiality and integrity through unknown vectors related to Deployment.

CVSS Base Score 7.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79424
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2012-3216
Remote attackers could affect confidentiality through unknown vectors related to File.

CVSS Base Score 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79436
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)

CVEID: CVE-2012-5070
Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Hotspot.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79430
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-5067
Remote attackers could affect confidentiality through unknown vectors related to Library.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79429
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-3143
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to JMX.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79419
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5076
A number of internal com.sun packages which should be restricted are not.

CVSS Base Score 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79418
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5077
An undisclosed vulnerability exists in a portion of the JRE related to Security.

CVSS Base Score 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79437
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-5073
Parts of the java.util.logging API do not check access permissions correctly.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79432
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)


CVEID: CVE-2012-5074
A number of internal com.sun packages which should be restricted are not.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79426
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVEID: CVE-2012-5075
Remote attackers could affect confidentiality through unknown vectors related to RMI.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79431
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-5083
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Swing.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79412
CVSS Environmental Score undefined
CVSS Vector (
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5072
Under certain circumstances the java.security.AccessController.doPrivilegedWithCombiner() method does not work correctly. This potentially allows malicious code to elevate its privileges.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79434
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-1531
An attacker can induce a crash by injecting a maliciously crafted font file which contains invalid data.

CVSS Base Score 10
CVSS Temporal Score: See
http://xforce.iss.net/xforce/xfdb/79413
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5081
Remote attackers could affect accessibility through unknown vectors related to Network.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79435
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2012-1532
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Web Start.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79417
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-1533
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Web Start. This is different from CVE-2012-1532.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79416
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5069
Remote attackers could affect confidentiality and integrity through unknown vectors related to ClassLoader.

CVSS Base Score 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79428
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)


CVEID: CVE-2012-5071
Part of the javax.management (JMX) API incorrectly allows access to sun.* classes, which should be restricted.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79427
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)


CVEID: CVE-2012-5084
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Swing. This is different from CVE-2012-5083.

CVSS Base Score 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79423
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5087
The class com.sun.beans.decoder.PropertyElementHandler does not check permissions correctly. This potentially allows malicious code to access restricted classes.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79415
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5086
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Beans.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79414
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5079
Remote attackers could affect integrity through unknown vectors related to Service.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79433
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)


CVEID: CVE-2012-5088
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Reflection.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79420
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)


CVEID: CVE-2012-5089
Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to RMI.

CVSS Base Score 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79422
CVSS Environmental Score undefined
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)

REFERENCES:

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

AFFECTED PLATFORMS:

  • IBM JRE 7.0 Service Release 2 or earlier, shipped with Rational Functional Tester
  • non-IBM Java 7.0


REMEDIATION:
IBM Rational Functional Tester 8.3.0.1 ships with IBM Java 7.0 Service Release 3 which addresses these security issues. If you are using a version of Rational Functional Tester earlier than 8.3.0.1, upgrade to version 8.3.0.1.

If you intend to use IBM Rational Functional Tester with a non-IBM Java 7.0, ensure that you upgrade to the latest Java 7.0 patches to fix the vulnerability security issues.

MITIGATION:
None found. Apply fixes.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Rational Functional Tester

Software version:

8.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.1, 8.1.0.1, 8.1.0.2, 8.1.0.3, 8.1.1, 8.1.1.1, 8.1.1.2, 8.1.1.3, 8.2, 8.2.0.1, 8.2.0.2, 8.2.1, 8.2.1.1, 8.2.2, 8.2.2.1, 8.3, 8.3.0.1

Operating system(s):

Linux, Windows

Reference #:

1619418

Modified date:

2012-12-19

Translate my page

Machine Translation

Content navigation