Security vulnerability in IBM HTTP Server for z/OS Version 5.3 (PM79239)

Vulnerability Details:

CVE ID: CVE-2012-5955

CVSS:

CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/80684 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/AU:N/C:C/I:C/A:C)


Versions Affected :

• IBM HTTP Server for z/OS Version 5.3

Solution:
For IBM HTTP Server for z/OS Version 5.3

• Apply PTF UK90469 or later which includes APAR PM79239 through normal customer ordering channels.

Important note from IBM Support: IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions at the System z Security Portal. Important security and integrity APARs and associated fixes will be posted to this portal. IBM suggests that any security or integrity fix be applied as soon as possible to minimize any potential risk.

Workaround(s): None.

Mitigation(s): None.



REFERENCES:

• Complete CVSS Guide
• On-line Calculator V2
• X-Force Vulnerability Database

RELATED INFORMATION:

• IBM Product Security Incident Response Blog
• IBM Secure Engineering Web Portal

CHANGE HISTORY:

• 19 December 2012: Original copy

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.