Security Bulletin
Summary
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014.
Vulnerability Details
The following three advisories are included in the IBM® SDK Java™ Technology Edition and WebSphere Application Server may be vulnerable to them.
CVEID: CVE-2014-4263
DESCRIPTION: An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact and no availability impact.
CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94606 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-4244
DESCRIPTION: An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact and no availability impact.
CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94605 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVEID: CVE-2014-3068
DESCRIPTION: A vulnerability in the Java Certificate Management System (CMS) keystore provider potentially allows brute-force private key recovery from CMS keystores.
CVSS Base Score: 2.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/93756 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:P/I:P/A:N)
The following advisories are included in the IBM Java SDK but WebSphere Application Server is not vulnerable to them. You will need to evaluate your own code to determine if you are vulnerable. Please refer to the Reference section for more information on the advisories not applicable to WebSphere Application Server:
CVE IDs:
CVE-2014-4227
CVE-2014-4262
CVE-2014-4216
CVE-2014-2490
CVE-2014-4223
CVE-2014-4219
CVE-2014-2483
CVE-2014-4209
CVE-2014-4220
CVE-2014-4268
CVE-2014-4218
CVE-2014-4252
CVE-2014-4252
CVE-2014-4266
CVE-2014-4262
CVE-2014-4265
CVE-2014-4221
CVE-2014-4208
CVE-2014-3086
Affected Products and Versions
- IBM Java SDK shipped with IBM WebSphere Application Server Version 8.5.0.0 through 8.5.5.2, Version 8.0.0.0 through 8.0.0.9, Version 7.0.0.0 through 7.0.0.33, Version 6.1.0.0 through 6.1.0.47
- This does not occur on IBM Java SDK shipped with WebSphere Application Servers Fix Packs 8.5.5.4, 8.0.0.10 and 7.0.0.35 or later.
For mixed cells that contain WebSphere Application Server version 6.0.2 nodes where Java 2 security is enabled, ensure APAR PM92206 or its circumvention is applied to the Deployment Manager to prevent sync operation failure. PM92206 has been delivered with an Interim Fix or with WebSphere Application Server Fix Packs 8.5.5.1 and 8.0.0.7 and 7.0.0.31 or later.
Remediation/Fixes
For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition :
Download and apply the interim fix APARs below, for your appropriate release:
For V8.5.0.0 through 8.5.5.2 Full Profile:
- Apply Interim Fix PI20795: Will upgrade you to IBM Java SDK Version 7R1 Service Refresh 1 Fix Pack 1 (optional)
- Apply Interim Fix PI20796: Will upgrade you to IBM Java SDK Version 7 Service Refresh 7 Fix Pack 1 (optional)
- Apply Interim Fix PI20797: Will upgrade you to IBM Java SDK Version 6R1 Service Refresh 8 Fix Pack 1 (required)
- Apply IBM Java SDK shipped with the WebSphere Application Server Fix pack 8.5.5.4 or later.
For 8.0.0.0 through 8.0.0.9:
- Apply Interim Fix PI20798: Will upgrade you to IBM Java SDK Version 6R1 Service Refresh 8 Fix Pack 1
- Apply IBM Java SDK shipped with WebSphere Application Server Fix pack 10 (8.0.0.10) or later.
For V7.0.0.0 through 7.0.0.33:
- Apply Interim Fix PI20799: Will upgrade you to IBM Java SDK Version 6 Service Refresh 16 Fix Pack 1
- Apply IBM Java SDK shipped with WebSphere Application Server Fix pack 35 (7.0.0.35) or later.
For V6.1.0.0 through 6.1.0.47:
- Contact IBM Support and apply Interim Fix PI20800: Will upgrade you to IBM Java SDK Version 5.0 Service Refresh 16 Fix Pack 7
For IBM WebSphere Application Server for i5/OS operating systems:
The IBM Developer Kit for Java is prerequisite software for WebSphere Application Server for IBM i. Please refer to Java on IBM i for updates on when these fixes will be available.
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Change History
06 August 2014: Original document published
11 August 2014: Fixed date to be 2014 instead of 2015 for 7.0.0.35
14 August 2014: added CVE-2014-3086 as not affected
18 August 2014: added link to IBM Java SDK Version 7R1 ifixes
18 September 2014: HP fixes have been published
13 November 2014: added CVE-2014-3068
04 December 2014: updated fixpack from 8.5.5.3 to 8.5.5.4
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21680418