IBM Support

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (CVE-2018-3180, CVE-2018-3139)

Security Bulletin


Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 8 and
IBM® Runtime Environment Java™ Technology Edition, Versions 6, 8 used by IBM Tivoli Netcool Configuration Manager.
These issues were disclosed as part of the IBM Java SDK updates in October 2018.

Vulnerability Details

If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities please refer to the link for “Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition" located in the “References” section for more information.
CVEID: CVE-2018-3180
DESCRIPTION: An unspecified vulnerability related to the Java SE JSSE component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 5.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/151497 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID: CVE-2018-3139
DESCRIPTION: An unspecified vulnerability related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/151455 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Tivoli Netcool Configuration Manager 6.4.1.x and 6.4.2.x

Remediation/Fixes

Only standalone OOBC and Worker servers need to be upgraded with the interim fixes listed in the table below.

Product

VRMF Remediation/First Fix
ITNCM 6.4.2
Upgrade to 6.4.2-TIV-ITNCM-FP008 in Q2 2018 or apply Apply ITNCM 6.4.2 Fix Pack 7 Interim Fix 01 (6.4.2.7-TIV_ITNCM-IF001) :
ITNCM 6.4.1
Apply ITNCM 6.4.1 Fix Pack 4 Interim Fix 10 (6.4.1.4-TIV-ITNCM-IF010) : 
Other ITNCM server configurations use Java as provided by the installed IBM® WebSphere Application Server. Please consult the linked security bulletin "Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2018 CPU" in the references below. Section "For V8.5.0.0 through 8.5.5.14 WebSphere Application Server Traditional and WebSphere Application Server Hypervisor Edition:" applies to ITNCM 6.4.2.x; while section "For V7.0.0.0 through 7.0.0.45 WebSphere Application Server and WebSphere Application Server Hypervisor Edition:" applies to ITNCM 6.4.1.x

Workarounds and Mitigations

None.

Get Notified about Future Security Bulletins

References

Off

Change History

13 March 2018: Initial version published.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7UH9","label":"Tivoli Netcool Configuration Manager"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF035","label":"z\/OS"}],"Version":"6.4.1;6.4.2","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 June 2023

UID

ibm10876000