IBM Support

Security Bulletin: IBM Tealeaf Customer Experience Replay Server internal proxy accepts connections from external sources (CVE-2016-5968)

Security Bulletin


Summary

The internal HTTP proxy server deployed as part of the IBM Tealeaf Customer Experience Replay Server accepts requests from any network host, not only from local renderers.

Vulnerability Details

CVEID: CVE-2016-5968
DESCRIPTION: IBM Tealeaf Replay Server allows remote attackers to use one of its web services as a proxy to forward HTTP requests to other internal/external Web resources.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116303 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Tealeaf Customer Experience 8.0-9.0.2

Remediation/Fixes

Product

VRMF
Remediation/First Fix
IBM Tealeaf Customer Experience
9.0.2A
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=9.0.2.5224_9.0.2A_IBMTealeaf_CXUpgrade_FixPack3
IBM Tealeaf Customer Experience
9.0.2
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=9.0.2.1223_IBMTealeaf_CXUpgrade_FixPack3
IBM Tealeaf Customer Experience
9.0.1A
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=9.0.1.5108_9.0.1A_IBMTealeaf_CXUpgrade_FixPack5
IBM Tealeaf Customer Experience
9.0.1
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=9.0.1.1117_IBMTealeaf_CXUpgrade_FixPack5
IBM Tealeaf Customer Experience
9.0.0, 9.0.0A
You can contact the Technical Support team for guidance.
IBM Tealeaf Customer Experience
8.8
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=8.8.0.9049_IBMTealeaf_CXUpgrade_FixPack9
IBM Tealeaf Customer Experience
8.7
https://www.ibm.com/support/entry/portal/search_results?sn=spe&filter=keywords:ibmsupportfixcentralsearch&q=8.7.1.8847_IBMTealeaf_CXUpgrade_FixPack10
IBM Tealeaf Customer Experience
8.6 and earlier
You can contact the Technical Support team for guidance.

Workarounds and Mitigations

Limit access to ports 38001 and 38002 on all systems running instances of the Replay Server to local processes.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

12 September 2016: Initial version

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSERNK","label":"Tealeaf Customer Experience"},"Business Unit":{"code":"BU055","label":"Cognitive Applications"},"Component":"--","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
16 June 2018

UID

swg21989374

Page Feedback