Security vulnerability in IBM HTTP Server for z/OS Version 5.3 (PM79239)

Flash (Alert)


Abstract

IBM HTTP Server for z/OS Version 5.3 could allow a remote attacker to execute arbitrary commands on the system.

Content

Vulnerability Details:

CVE ID: CVE-2012-5955

CVSS:

CVSS Base Score: 10
CVSS Temporal Score: See
http://xforce.iss.net/xforce/xfdb/80684 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/AU:N/C:C/I:C/A:C)



Versions Affected :

  • IBM HTTP Server for z/OS Version 5.3

Solution:
For IBM HTTP Server for z/OS Version 5.3
  • Apply PTF UK90469 or later which includes APAR PM79239 through normal customer ordering channels.


Important note from IBM Support: IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions at the System z Security Portal. Important security and integrity APARs and associated fixes will be posted to this portal. IBM suggests that any security or integrity fix be applied as soon as possible to minimize any potential risk.

Workaround(s): None.

Mitigation(s): None.



REFERENCES:
RELATED INFORMATION:

CHANGE HISTORY:
  • 19 December 2012: Original copy

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.


Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.


Rate this page:

(0 users)Average rating

Document information


More support for:

WebSphere Application Server for z/OS
IBM HTTP Server

Software version:

5.3

Operating system(s):

OS/390, z/OS

Reference #:

1620945

Modified date:

2012-12-19

Translate my page

Machine Translation

Content navigation