Security Bulletin
Summary
There are multiple vulnerabilities in Open Source Apache Tomcat that is used by IBM Cognos TM1, These were disclosed in the 02/09/2015, 04/09/2015 and 05/14/2015 X-Force Reports. Additionally, there are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 and IBM® Runtime Environment Java™ Technology Edition, Version 7 that are used by IBM Cognos Business Intelligence. These issues were disclosed as part of the IBM Java SDK updates in April and July 2015. Also multiple vulnerabilities were reported for OpenSSL in March 2015 that affect TM1. This bulletin also addresses LOGJAM: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. TM1 9.5.2 is only affected by the OpenSSL vulnerabilities.
Vulnerability Details
CVEID: CVE-2015-0207 CVEID: CVE-2015-0208 CVEID: CVE-2015-0285 CVEID: CVE-2015-0286 CVEID: CVE-2014-0230 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by missing limitations on request body size. By sending a specially crafted request to the server, an attacker could keep a connection open and force Tomcat to keep a processing thread allocated to the connection. CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102131 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVEID: CVE-2014-0227 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed chunked header to the Web server to cause multiple processing conflicts on the servers. An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100751 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker could exploit this vulnerability to bypass the protections of a Security Manager. CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103155 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N) CVEID: CVE-2015-1916 DESCRIPTION: Server applications which use the IBM Java Secure Socket Extension provider to accept SSL/TLS connections are vulnerable to a denial of service attack due to an unspecified vulnerability. CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101995 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVEID: CVE-2015-1914 CVEID: CVE-2015-0204 CVEID: CVE-2015-4000 CVEID: CVE-2015-1931 DESCRIPTION: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. CVSS Base Score: 2.1 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102967 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N) |
Affected Products and Versions
IBM Cognos TM1 10.2.2
IBM Cognos TM1 10.2
IBM Cognos TM1 10.1.1
IBM Cognos TM1 9.5.2
Remediation/Fixes
The recommended solution is to apply the fix as soon as practical. The fix can be downloaded at the following locations:
Cognos TM1 10.2.2 FP4
http://www.ibm.com/support/docview.wss?uid=swg24040539
Cognos TM1 10.2.0.2 Interim Fix 5
http://www-01.ibm.com/support/docview.wss?uid=swg24040710
Cognos TM1 10.1.1.2 Interim Fix 5
http://www-01.ibm.com/support/docview.wss?uid=swg24040709
Cognos TM1 9.5.2 Fix Pack 3 Interim Fix 8
http://www-01.ibm.com/support/docview.wss?uid=swg24040708
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21966177