IBM Support

Security Bulletin: Multiple Denial of Service vulnerabilities with Expat may affect IBM HTTP Server

Security Bulletin


Summary

There are several vulnerabilities that may affect IBM HTTP Server that is used by WebSphere Application Server.

Vulnerability Details


CVEID: CVE-2012-0876
DESCRIPTION:
Expat is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple specially-crafted HTTP POST requests to an affected application containing conflicting hash key values, a remote attacker could exploit this vulnerability to cause the consumption of CPU resources.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/73868 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2012-1148
DESCRIPTION:
Expat is vulnerable to a denial of service, caused by a memory leak in poolGrow when handling XML data. A remote attacker could exploit this vulnerability to cause the application using the vulnerable XML parsing library to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/73867 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2016-4472
DESCRIPTION:
Expat XML parser is vulnerable to a denial of service, caused by the removal by compilers with certain optimization settings. By using a specially-crafted XML data, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114683 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-0718
DESCRIPTION:
Expat is vulnerable to a buffer overflow, caused by improper bounds checking when processing malformed XML data. By using the Expat library, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113408 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

These vulnerabilities affects the following versions and releases of IBM HTTP Server (powered by Apache) component in all editions of WebSphere Application Server and bundling products.

  • Version 9.0
  • Version 8.5.5
  • Version 8.5
  • Version 8.0
  • Version 7.0

Remediation/Fixes

For affected IBM HTTP Server for WebSphere Application Server: The recommended solution is to apply the interim fix, Fix Pack or PTF containing APAR PI66849 for each named product as soon as practical. The original PI66849 interim fixes for these issues have been superseded by the PI73984 fix for more recent vulnerabilities. Please refer to the security bulletins below for the updated interim fixes.

For V9.0.0.0 through 9.0.0.1
:

· Refer to security bulletin and apply interim fix PI73984

--OR--
· Apply Fix Pack 9.0.0.2 or later.

For V8.5.0.0 through 8.5.5.10:

· Refer to security bulletin and apply interim fix PI73984

--OR--
· Apply Fix Pack 8.5.5.11 or later.


For V8.0.0.0 through 8.0.0.12:

· Refer to security bulletin and apply interim fix PI73984

--OR--
· Apply Fix Pack 8.0.0.13 or later.


For V7.0.0.0 through 7.0.0.41:

· Refer to security bulletin and apply interim fix PI73984

--OR--
· Apply Fix Pack 7.0.0.43 or later.

Get Notified about Future Security Bulletins

References

Complete CVSS v2 Guide
On-line Calculator v2
Complete CVSS v3 Guide
On-line Calculator v3

Related information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

16 August 2016: original document published
17 August 2016: added WebSphere Application Server notification
13 September 2016: scoring changed for CVE-2016-0718 and updated fixpack estimated dates
13 April 2017: updated to later security interim fixes

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information
Segment Product Component Platform Version Edition
Application Servers WebSphere Application Server

Document information

More support for: IBM HTTP Server

Software version: 7.0, 8.0, 8.5, 8.5.5, 9.0

Operating system(s): AIX, HP-UX, IBM i, Linux, Solaris, Windows, z/OS

Software edition: All Editions

Reference #: 1988026

Modified date: 13 September 2016


Translate this page: