IBM Support

Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2017-15698, CVE-2017-15706, CVE-2018-1304, CVE-2018-1305)

Security Bulletin


Summary

Multiple vulnerabilities in Open Source Apache Tomcat reported by The Apache Software Foundation affect IBM Tivoli Application Dependency Discovery Manager

Vulnerability Details

CVEID: CVE-2017-15706
DESCRIPTION:
Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the CGI Servlet to identify which script to execute. The error resulted in the failure of some scripts to execute as expected and other scripts may have been executed unexpectedly.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138486 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2017-15698
DESCRIPTION:
Apache Tomcat Native Connector could allow a remote attacker to bypass security restrictions, caused by the improper handling of fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. The parsing error resulted in the OCSP check being omitted and made it possible for client certificates that should have been rejected to be accepted.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138491 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-1305
DESCRIPTION:
Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraints that are defined by annotations of Servlets in certain cases. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139475 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID: CVE-2018-1304
DESCRIPTION:
Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraint definitions that contain a URL pattern of "" (the empty string) that exactly maps to the context root. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139476 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

TADDM 7.2.2.0 - 7.2.2.5
TADDM 7.3.0.0 (TADDM 7.3.0.1-4 - not affected - using WebSphere Liberty Profile)

Remediation/Fixes


Below are eFixes prepared on top of the latest 7.2.2 FP5 level and 7.3.0.0 (7.3.0.1+ not affected);

Fix VRMF APAR How to acquire fix
efix_taddm73_tomcat7085_201411291020.zip 7.3.0.0 None Download eFix
efix_taddm722_tomcat7085_FP520160209.zip 7.2.2.5
None Download eFix

Please get familiar with eFix readme in etc/<efix_name>_readme.txt
Note that the eFix requires manual deletion of the external/apache-tomcat directory.

Workarounds and Mitigations


The only solution is to apply eFix prepared to specific TADDM version (7.2.2.5 or 7.3.0.0). This fix is only tested for TADDM versions 7.2.2.5 or 7.3.0.0. Though, if applied to the other maintenance levels, it should not lead to any issue, but if it does, consider upgrading to the latest maintenance level to apply this fix.

Get Notified about Future Security Bulletins

References

Complete CVSS v3 Guide
On-line Calculator v3

Related information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

23-Apr-18 - Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document information

More support for: Tivoli Application Dependency Discovery Manager

Software version: 7.2.2, 7.3

Operating system(s): AIX, Linux, Windows

Reference #: 2015795

Modified date: 17 May 2018


Translate this page: