Denial of Service Security Exposure

Flash

This Security Alert addresses a serious security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number).

This vulnerability can cause the Java Runtime Environment to go into a hang, infinite loop, and/or crash resulting in a denial of service exposure. This same hang can occur if the number is written without scientific notation (324 decimal places). In addition to the Application Server being exposed to this attack, any Java program using the Double.parseDouble method is also at risk of this exposure including any customer written application or third party written application.

The following IBM Tivoli products contain affected versions of the Java Runtime Environment:

Product Name	Actions
Application Manager for Smart Business	http://www-01.ibm.com/support/docview.wss?uid=swg21469222
Change and Configuration Management Database	http://www-01.ibm.com/support/docview.wss?uid=swg21469399
CloudBurstV1.2	http://www-01.ibm.com/support/docview.wss?uid=swg21468934
CloudBurstV2.1	http://www-01.ibm.com/support/docview.wss?uid=swg21468933
Information Archive	Contact L2
License Metric Tool	http://www-01.ibm.com/support/docview.wss?uid=swg21469477
Maximo Adapter for Microsoft Project	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Adapter for Primavera	http://www-01.ibm.com/support/docview.wss?uid=swg21469011
Maximo Archiving with Optim Data Growth Solution	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Configuration Manager	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management Essentials	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management for Energy Optimization	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Management Scheduler	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Asset Navigator	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Calibration	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Change and Corrective Action Manager	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Data Center Infrastructure Management	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo e-Commerce Adapter	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo ECRI Integration for Healthcare	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter for Oracle	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Enterprise Adapter for SAP	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Everyplace	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Government	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Life Sciences	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Nuclear Power	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Oil and Gas	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Service Providers	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Transportation	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo for Utilities	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Linear Asset Management	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Asset Manager	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Inventory Manager	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Suite	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Mobile Work Manager	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Property Performance Management Systems	See Maximo Asset Mgmt- https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo SLA Manager	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Space Management for Facilities	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Maximo Spatial Asset Management	https://www-304.ibm.com/support/docview.wss?uid=swg21468850
Prospect	http://www-01.ibm.com/support/docview.wss?uid=swg21469197
Security Information and Event Manager	Contact IBM Support
Service Delivery Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468932
"Service Manager for Smart Business (formerly Tivoli Foundations Service Manager)	http://www-01.ibm.com/support/docview.wss?uid=swg21469069
System Storage ProductivityCenter	http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli Access Manager for e-business	http://www-01.ibm.com/support/docview.wss?uid=swg24028828
Tivoli Access Manager for Enterprise Single Sign-on	http://www-01.ibm.com/support/docview.wss?uid=swg21469013
Tivoli Access Manager for Operating Systems	See Tivoli Access Manager for e-business http://www-01.ibm.com/support/docview.wss?uid=swg21459999
Tivoli Access Manager for Operating Systems Agent	Contact IBM Support
Tivoli Application Dependency Discovery Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468728
Tivoli Application Dependency Discovery Manager - Sensor Interim Feature	See TADDM- http://www-01.ibm.com/support/docview.wss?uid=swg21468728
Tivoli Asset Discovery for Distributed	http://www-01.ibm.com/support/docview.wss?uid=swg21469850
Tivoli Asset Discovery for zOS	http://www-01.ibm.com/support/docview.wss?uid=swg21468894
Tivoli Asset Management for IT	http://www-01.ibm.com/support/docview.wss?uid=swg21469010
Tivoli Business Service Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Business Service Manager for the Enterprise.	See TBSM- http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Common Reporting	http://www-01.ibm.com/support/docview.wss?uid=swg21469046
Tivoli Common Reporting for Asset and Performance Management	http://www-01.ibm.com/support/docview.wss?uid=swg21469046
Tivoli Compliance Insight Manager	Contact IBM Support
Tivoli Composite Application Manager Agent for WebSpehre DataPower Appliance	See ITCAMfSOA- http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for Application Diagnostics	http://www-01.ibm.com/support/docview.wss?uid=swg21469154
Tivoli Composite Application Manager for Applications	http://www-01.ibm.com/support/docview.wss?uid=swg21469054
Tivoli Composite Application Manager for J2EE	http://www-01.ibm.com/support/docview.wss?uid=swg21469154
Tivoli Composite Application Manager for SOA	http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for SOA Platform	ITCAMfSOA - http://www-01.ibm.com/support/docview.wss?uid=swg21468841 ITM http://www-01.ibm.com/support/docview.wss?uid=swg21468884 ITCAMfAD http://www-01.ibm.com/support/docview.wss?uid=swg21469154 ITCAMfAPPS http://www-01.ibm.com/support/docview.wss?uid=swg21469054 ITMfVS (see ITM) http://www-01.ibm.com/support/docview.wss?uid=swg21468884 ITCAMfDP http://www-01.ibm.com/support/docview.wss?uid=swg21468841
Tivoli Composite Application Manager for Transactions	http://www-01.ibm.com/support/docview.wss?uid=swg21469183
Tivoli Composite Application Manager for Web Resources	http://www-01.ibm.com/support/docview.wss?uid=swg21469261
Tivoli Composite Application Manager for WebSphere	http://www-01.ibm.com/support/docview.wss?uid=swg21469264
Tivoli Configuration Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469229
Tivoli Data Warehouse	http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Directory Integrator	http://www-01.ibm.com/support/docview.wss?uid=swg21468697
Tivoli Directory Integrator for zOS	http://www-01.ibm.com/support/docview.wss?uid=swg21468697
Tivoli Directory Server	https://www-304.ibm.com/support/docview.wss?uid=swg21469296
Tivoli Dynamic Workload Broker	http://www-01.ibm.com/support/docview.wss?uid=swg21468705
Tivoli Enterprise Console	http://www-01.ibm.com/support/docview.wss?uid=swg21469001
Tivoli Federated Identity Manager	V6.2.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24028822 V6.2 - http://www-01.ibm.com/support/docview.wss?uid=swg24025908 V6.1.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24021066
Tivoli Federated Identity Manager Business Gateway	V6.2.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24028833 V6.2 - http://www-01.ibm.com/support/docview.wss?uid=swg24025909 V6.1.1 - http://www-01.ibm.com/support/docview.wss?uid=swg24021277
Tivoli Foundations Application Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469222
Tivoli Foundations Service Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469069
Tivoli Identity Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468875
Tivoli Identity Manager for zOS V5.0	http://www-01.ibm.com/support/docview.wss?uid=swg21468875
Tivoli Integration Composer	https://www-304.ibm.com/support/docview.wss?uid=swg21469010
Tivoli Key Lifecycle Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468857
Tivoli License Compliance Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21474490
Tivoli Management Framework	http://www-01.ibm.com/support/docview.wss?uid=swg21470094
Tivoli Monitoring	http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Monitoring for Active Directory	http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Monitoring for Applications	ITCAM for Applications - http://www-01.ibm.com/support/docview.wss?uid=swg21469054 .
Tivoli Monitoring for Databases	See ITCAM for Applications - http://www-01.ibm.com/support/docview.wss?uid=swg21469054 ".
Tivoli Monitoring for Energy Management	See ITM: - http://www-01.ibm.com/support/docview.wss?uid=swg21468884 See Systems Director - http://www-01.ibm.com/support/docview.wss?uid=swg21469284
Tivoli Monitoring for Messaging and Collaboration	ITCAM for Applications - http://www-01.ibm.com/support/docview.wss?uid=swg21469054 .
Tivoli Monitoring for Virtual Servers	http://www-01.ibm.com/support/docview.wss?uid=swg21469354
Tivoli Netcool Configuration Manager	See WAS fix - http://www-01.ibm.com/support/docview.wss?uid=swg24029110
Tivoli Netcool Configuration Manager (LegacyIntellidenVersionsPre6.x)	Fix available for Oracle - http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Tivoli Netcool Enterprise VoIP Manager	Contact IBM Support
Tivoli Netcool Impact	http://www-01.ibm.com/support/docview.wss?uid=swg21468724
Tivoli Netcool Performance Manager (Wireless)	http://www-01.ibm.com/support/docview.wss?uid=swg21468927
Tivoli Netcool Performance Manager (Wireline)	http://www-01.ibm.com/support/docview.wss?uid=swg21468849
Tivoli Netcool Performance Manager for Wireless Development Toolkit	http://www-01.ibm.com/support/docview.wss?uid=swg21468927
Tivoli Netcool Portal	http://www-01.ibm.com/support/docview.wss?uid=swg21468915
Tivoli Netcool Service Quality Management Center	TNSQM- http://www-01.ibm.com/support/docview.wss?uid=swg21469232 TBSM URL- http://www-01.ibm.com/support/docview.wss?uid=swg21468752
Tivoli Netcool Service Quality Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469232
Tivoli Netcool/OMNIbus	See Omnibus - http://www-01.ibm.com/support/docview.wss?uid=swg21469003 See WebGUI - http://www-01.ibm.com/support/docview.wss?uid=swg21469042 "
Tivoli Netcool/Reporter	http://www-01.ibm.com/support/docview.wss?uid=swg21468912
Tivoli Netcool/WebGUI	http://www-01.ibm.com/support/docview.wss?uid=swg21469042
Tivoli Netview (Distributed)	http://www-01.ibm.com/support/docview.wss?uid=swg21468987
Tivoli NetView for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21469285
Tivoli Network Manager Entry Edition	http://www-01.ibm.com/support/docview.wss?uid=swg21469132
Tivoli Network Manager IP Edition	http://www-01.ibm.com/support/docview.wss?uid=swg21469074
Tivoli Network Manager Transmission Edition	http://www-01.ibm.com/support/docview.wss?uid=swg21469056
Tivoli OMEGAMON DE on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for CICS on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for CICS TG on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for DB2 Performance Expert for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for DB2 Performance Monitor for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for IMS on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for Mainframe Networks	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE for Messaging	See ITM - http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli OMEGAMON XE for Messaging for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21469441
Tivoli OMEGAMON XE for Storage on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE on z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON XE on z/VM and Linux	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMEGAMON z/OS Management Console	http://www-01.ibm.com/support/docview.wss?uid=swg21468976
Tivoli OMNIbus and Network Manager	See ITNM IP - http://www-01.ibm.com/support/docview.wss?uid=swg21469074 See OMNIbus - http://www-01.ibm.com/support/docview.wss?uid=swg21469003
Tivoli Performance Analyzer	See ITM http://www-01.ibm.com/support/docview.wss?uid=swg21468884
Tivoli Policy Driven Software Distribution	http://www-01.ibm.com/support/docview.wss?uid=swg21470544
Tivoli Provisioning Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469248
Tivoli Provisioning Manager Express for Inventory	http://www-01.ibm.com/support/docview.wss?uid=swg21469098
Tivoli Provisioning Manager Express for S/W Distribution	http://www-01.ibm.com/support/docview.wss?uid=swg21469105
Tivoli Provisioning Manager for Software	Contact IBM Support
Tivoli Release Process Manager	See CCMDB http://www-01.ibm.com/support/docview.wss?uid=swg21469399
Tivoli Remote Control	http://www-01.ibm.com/support/docview.wss?uid=swg21468949
Tivoli Security Policy Manager V7.0 (TSPM & RTSS)	TSPM - http://www-01.ibm.com/support/docview.wss?uid=swg24022274 RTSS - http://www-01.ibm.com/support/docview.wss?uid=swg24022275
Tivoli Security Policy Manager V7.1 (TSPM & RTSS)	TSPM - http://www-01.ibm.com/support/docview.wss?uid=swg24028456 RTSS - http://www-1.ibm.com/support/docview.wss?uid=swg24028455
Tivoli Service Automation Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469961
Tivoli Service Level Advisor	Contact IBM Support
Tivoli Service Request Manager	See CCMDB http://www-01.ibm.com/support/docview.wss?uid=swg21469399
Tivoli Storage Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager Extended Edition	http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager FastBack	http://www-01.ibm.com/support/docview.wss?uid=swg21469209
Tivoli Storage Manager FastBack for Workstations	http://www-01.ibm.com/support/docview.wss?uid=swg21468271
Tivoli Storage Manager for Space Management	See TSM- http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Manager for Storage Area Networks	http://www-01.ibm.com/support/docview.wss?uid=swg21469266
Tivoli Storage Productivity Center	http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli Storage Productivity Center for Replication	http://www-01.ibm.com/support/docview.wss?uid=swg21469084
Tivoli System Automation Application Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21468860
Tivoli System Automation for Integrated Operations Management	http://www-01.ibm.com/support/docview.wss?uid=swg21468861
Tivoli System Automation for Multiplatforms	http://www-01.ibm.com/support/docview.wss?uid=swg21468856
Tivoli System Automation for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468862
Tivoli Usage and Accounting Manager	http://www-01.ibm.com/support/docview.wss?uid=swg21469080
Tivoli Workload Scheduler	http://www-01.ibm.com/support/docview.wss?uid=swg21468704
Tivoli Workload Scheduler for Applications	http://www-01.ibm.com/support/docview.wss?uid=swg21468709
Tivoli Workload Scheduler for z/OS	http://www-01.ibm.com/support/docview.wss?uid=swg21468747

Consult the following links for related product information:

WebSphere® specific instructions to address this vulnerability:
http://www-01.ibm.com/support/docview.wss?uid=swg21462019

DB2® specific instructions to address this vulnerability
https://www-304.ibm.com/support/docview.wss?uid=swg21468291

Tivoli Common Reporting instructions:
http://www-01.ibm.com/support/docview.wss?uid=swg21469046