Security Bulletin: Vulnerabilities in Rational Functional Tester versions 8.x due to security vulnerabilities in IBM JRE 7.0 Service Release 2 or earlier, and non-IBM Java 7.0

Security Bulletin


Summary

Multiple security vulnerabilities exist in the Java Runtime Environments (JREs) IBM JRE 7.0 Service Release 1 or earlier, and non-IBM Java 7.0 or earlier, that can affect the security of Rational Functional Tester. Fixes are available in IBM JRE 7.0 Service Release 3 and in the latest Java 7.0 patches.

Vulnerability Details

Subscribe to My Notifications to be notified of important product support alerts like this.
  • Follow this link for more information (requires login with your IBM ID)

CVE IDs: CVE-2012-3159, CVE-2012-3216, CVE-2012-5070, CVE-2012-5067, CVE-2012-3143, CVE-2012-5076, CVE-2012-5077, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-1532, CVE-2012-1533, CVE-2012-5069, CVE-2012-5071, CVE-2012-5084, CVE-2012-5087, CVE-2012-5086, CVE-2012-5079, CVE-2012-5088, CVE-2012-5089

Description: Vulnerabilities exist in the following JREs that can impact the security of Rational Functional Tester:
  1. IBM JRE 7.0 Service Release 2 or earlier that is shipped with Rational Functional Tester
  2. Non-IBM Java 7.0 or earlier, when used with Rational Functional Tester
Fixes are available in IBM JRE 7.0 Service Release 3 (shipped with Rational Functional Tester version 8.3.0.1) and in the latest Java 7.0 patches.

CVEID: CVE-2012-3159

Description: Remote attackers could affect confidentiality and integrity through unknown vectors related to Deployment.

CVSS Base Score 7.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79424
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:P/A:P)


CVEID: CVE-2012-3216

Description: Remote attackers could affect confidentiality through unknown vectors related to File.

CVSS Base Score 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79436
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:H/Au:N/C:P/I:N/A:N)


CVEID: CVE-2012-5070

Description: Remote attackers could affect confidentiality, integrity, and availability through unknown vectors related to Hotspot.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79430
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:N)



CVEID: CVE-2012-5067

Description: Remote attackers could affect confidentiality through unknown vectors related to Library.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79429
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:N)



CVEID: CVE-2012-3143

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to JMX.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79419
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5076

Description: A number of internal com.sun packages which should be restricted are not.

CVSS Base Score 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79418
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5077

Description: An undisclosed vulnerability exists in a portion of the JRE related to Security.

CVSS Base Score 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79437
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:H/Au:N/C:P/I:N/A:N)



CVEID: CVE-2012-5073

Description: Parts of the java.util.logging API do not check access permissions correctly.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79432
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:P/A:N)


CVEID: CVE-2012-5074

Description: A number of internal com.sun packages which should be restricted are not.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79426
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:P/A:N)


CVEID: CVE-2012-5075

Description: Remote attackers could affect confidentiality through unknown vectors related to RMI.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79431
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:N)



CVEID: CVE-2012-5083

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Swing.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79412
CVSS Environmental Score undefined
CVSS Vector ((AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5072

Description: Under certain circumstances the java.security.AccessController.doPrivilegedWithCombiner() method does not work correctly. This potentially allows malicious code to elevate its privileges.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79434
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:P/I:N/A:N)



CVEID: CVE-2012-1531

Description: An attacker can induce a crash by injecting a maliciously crafted font file which contains invalid data.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79413
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5081

Description: Remote attackers could affect accessibility through unknown vectors related to Network.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79435
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:N/A:P)


CVEID: CVE-2012-1532

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Web Start.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79417
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-1533

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Web Start. This is different from CVE-2012-1532.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79416
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5069

Description: Remote attackers could affect confidentiality and integrity through unknown vectors related to ClassLoader.

CVSS Base Score 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79428
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:M/Au:N/C:P/I:P/A:N)



CVEID: CVE-2012-5071

Description: Part of the javax.management (JMX) API incorrectly allows access to sun.* classes, which should be restricted.

CVSS Base Score 6.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79427
CVSS Environmental Score undefined
CVSS Vector(AV:N/AC:L/Au:N/C:P/I:P/A:N)



CVEID: CVE-2012-5084

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Swing. This is different from CVE-2012-5083.

CVSS Base Score 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79423
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:H/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5087

Description: The class com.sun.beans.decoder.PropertyElementHandler does not check permissions correctly. This potentially allows malicious code to access restricted classes.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79415
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5086

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Beans.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79414
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5079

Description: Remote attackers could affect integrity through unknown vectors related to Service.

CVSS Base Score 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79433
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:N/I:P/A:N)



CVEID: CVE-2012-5088

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to Reflection.

CVSS Base Score 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79420
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)



CVEID: CVE-2012-5089

Description: Remote attackers could affect confidentiality, integrity, and accessibility through unknown vectors related to RMI.

CVSS Base Score 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79422
CVSS Environmental Score undefined
CVSS Vector (AV:N/AC:H/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM JRE 7.0 Service Release 2 or earlier, shipped with Rational Functional Tester and non-IBM Java 7.0

Remediation/Fixes

Upgrade to Rational Functional Tester Fix Pack 1 (8.3.0.1) for 8.3.

If you intend to use IBM Rational Functional Tester with a non-IBM Java 7.0, ensure that you upgrade to the latest Java 7.0 patches to fix the vulnerability security issues.

Workarounds and Mitigations

None

References

Related information

Acknowledgement

None

Change History

* 19 December 2012: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Rational Functional Tester
General Information

Software version:

8.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.1, 8.1.0.1, 8.1.0.2, 8.1.0.3, 8.1.1, 8.1.1.1, 8.1.1.2, 8.1.1.3, 8.2, 8.2.0.1, 8.2.0.2, 8.2.1, 8.2.1.1, 8.2.2, 8.2.2.1, 8.3, 8.3.0.1

Operating system(s):

Linux, Windows

Reference #:

1619418

Modified date:

2012-12-19

Translate my page

Machine Translation

Content navigation