IBM Support

Security Bulletin: Multiple vulnerabilities have been identified in IBM Business Process Manager, and bundled products shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise

Security Bulletin


Summary

Security Bulletin: Multiple vulnerabilities have been identified in IBM Business Process Manager, and bundled products shipped with IBM Cloud Orchestrator, SmartCloud Orchestrator, Cloud Orchestrator Enterprise and SmartCloud Orchestrator Enterprise Editions.

Vulnerability Details

IBM Business Process Manager, IBM Tivoli System Automation Application Manager are shipped with IBM Cloud Orchestrator, SmartCloud Orchestrator, IBM Cloud Orchestrator Enterprise and SmartCloud Orchestrator Editions. IBM HTTP Server is shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise Editions.

IBM Tivoli Monitoring is shipped with IBM Cloud Orchestrator Enterprise and SmartCloud Orchestrator Enterprise Editions.

CVEID: CVE-2015-1283
DESCRIPTION: Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104964 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2015-3183
DESCRIPTION:
Apache HTTP Server is vulnerable to HTTP request smuggling, caused by a chunk header parsing flaw in the apr_brigade_flatten() function. By sending a specially-crafted request in a malformed chunked header to the Apache HTTP server, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base Score: 6.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104844 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2015-4947
DESCRIPTION:
IBM HTTP Server Administration Server could be vulnerable to a stack buffer overflow, caused by improper handling of user input. An authenticated remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104912 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Principal Product and Version Affected Supporting Product and Version
IBM Cloud Orchestrator V2.5 IBM Business Process Manager Standard V8.5.6
IBM HTTP Server V8.5.5
IBM Tivoli System Automation Application Manager V4.1
IBM Cloud Orchestrator V2.4, V2.4.0.1, V2.4.0.2 and V2.4.0.2 Interim Fix 1 IBM Business Process Manager Standard V8.5.0.1
IBM HTTP Server V8.5
IBM Tivoli System Automation Application Manager V4.1
IBM Cloud Orchestrator Enterprise V2.5 IBM Business Process Manager Standard V8.5.6
IBM HTTP Server V8.5.5
IBM Tivoli System Automation Application Manager V4.1
IBM Tivoli Monitoring V6.3.0.2
IBM Cloud Orchestrator Enterprise V2.4, V2.4.0.1, V2.4.0.2 and V2.4.0.2 Interim Fix 1 IBM Business Process Manager Standard V8.5.0.1
IBM HTTP Server V8.5
IBM Tivoli System Automation Application Manager V4.1
IBM Tivoli Monitoring V6.3.0.2
IBM SmartCloud Orchestrator V2.3, V2.3.0.1 from Interim Fix 1 to Interim Fix 8 IBM Business Process Manager Standard V8.5
IBM Tivoli System Automation Application Manager V3.2.2
IBM SmartCloud Orchestrator Enterprise V2.3, V2.3.0.1 from Interim Fix 1 to Interim Fix 8 IBM Business Process Manager Standard V8.5
IBM Tivoli System Automation Application Manager V3.2.2
IBM Tivoli Monitoring V6.3.0.2

Remediation/Fixes

The recommended solution is to apply the fixes as soon as practical. Review the information below on the available fixes.

If you are running IBM Cloud Orchestrator V2.5 upgrade to IBM Cloud Orchestrator V2.5.0.1 or later IBM Cloud Orchestrator V2.5.0.1 Interim Fix 1 for V2.5.0.1.

If you are running IBM Cloud Orchestrator V2.4, V2.4.0.1, V2.4.0.2 or V2.4.0.2 Interim Fix 1 upgrade to IBM Cloud Orchestrator V2.4 Fix Pack 3.


If you are running IBM SmartCloud Orchestrator V2.3, V2.3.0.1, or V2.3.0.1 from Interim Fix 1 to Interim Fix 8 upgrade to IBM SmartCloud Orchestrator V2.3.0.1 Interim Fix 9.

For affected supporting products shipped with IBM Cloud Orchestrator, review the security bulletins below for vulnerability details and fixes.

For affected supporting products shipped with IBM Cloud Orchestrator Enterprise and SmartCloud Enterprise, review the security bulletins below for vulnerability details and fixes.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Related information

Change History

* 06 April 2016: Updated CVE-2015-1283 Description
* 15 March 2016: Original Copy Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document information

More support for: IBM Cloud Orchestrator
Security

Software version: 2.3, 2.3.0.1, 2.4, 2.4.0.1, 2.4.0.2, 2.5

Operating system(s): Linux

Reference #: C1000112

Modified date: 10 April 2016