Security Bulletin
Summary
Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server, IBM WebSphere Application Server Hypervisor, WebSphere Application Server Liberty Profile and IBM HTTP Server.
Vulnerability Details
CVEID: CVE-2015-1932
DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Virtual Enterprise could allow a remote attacker to obtain information that identifies the proxy server software being used.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102970 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.
Fix:
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI38403, as noted below:
Note:
By default, the ODR and proxy server will ignore the http.compliance.via custom property and not set the HTTP Via header. A new custom property is being introduced that if set to false will allow the http.compliance.via setting to be honored. The custom property, http.ignore.compliance.via can be set on an ODR or Proxy server.
In the Administrative console, expand Servers>Server Types > On Demand Routers > server_name to open the configuration tab for the server.
Expand On Demand Router settings, click On Demand Router Properties
Under Additional properties, click Custom properties > new.
For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Hypervisor Edition and IBM WebSphere Virtual Enterprise
For V8.5.0.0 through 8.5.5.6:
-- OR
For V8.0.0.0 through 8.0.0.10:
-- OR
For V7.0.0.0 through 7.0.0.37:
-- OR
For IBM WebSphere Virtual Enterprise using WebSphere Application Server V7.0 and V8.0:
-- OR
Workaround(s): None known
Mitigation(s): Remove the custom property http.compliance.via or set it to false.
To remove the custom property http.compliance.via:
In the Administrative console, expand Servers>Server Types > On Demand Routers > server_name to open the configuration tab for the server.
Expand On Demand Router Properties, click On Demand Router Settings
Under Additional properties, click Custom properties, select the check box next to http.compliance.via property and press the Delete button.
Alternatively, to set the property to false, click on http.compliance.via and change the value of the property to false and press the OK button.
CVEID: CVE-2015-4938
DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this vulnerability to persuade the user into entering sensitive information.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104415 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.
Fix:
Apply an Interim Fix , Fix Pack or PTF containing this APAR PI37396, as noted below:
For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition
For V8.5.0.0 through 8.5.5.6:
-- OR
For V8.0.0.0 through 8.0.0.10:
-- OR
For V7.0.0.0 through 7.0.0.37:
-- OR
Workaround(s): None known
Mitigation(s): None known
Other APARs shipped with 8.5.5.7 are included in the security bulletins below:
PI39833 Security bulletin for IBM HTTP Server Windows Denial of Service
PI42928 Security bulletin for IBM HTTP Server HTTP request smuggling
PI44793 Security bulletin for IBM HTTP Server Stack Buffer overflow
PI44809 Security bulletin for IBM HTTP Server Denial of Service
PI45596 Security bulletin for IBM HTTP Server Denial of Service
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Change History
11 September 2015: original document published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
07 September 2022
UID
swg21965444