Security Bulletin: Security vulnerabilities in IBM SDK, Java™ Technology Edition (CVE-2014-0878, CVE-2014-0460, CVE-2014-0453, CVE-2014-2420) affect SmartCloud Provisioning

Vulnerability Details

CVE ID: CVE-2014-0878
DESCRIPTION: Product applicability to say: vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic providers. This flaw potentially allows an attacker to predict the output of the random number generator under certain circumstances.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91084
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVE ID: CVE-2014-0460
DESCRIPTION: Product applicability to say: the JNDI DNS service provider has several implementation flaws that make spoofing DNS responses much easier.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92482
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVE ID: CVE-2014-0453
DESCRIPTION: Product applicability to say: an Exception thrown by the Security component reveals information that an attacker could use to break RSA keys via a Bleichenbacher attack.
CVSS Base Score: 4
CVSS Temporal Score:See https://exchange.xforce.ibmcloud.com/vulnerabilities/92490
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVE ID: CVE-2014-2420
DESCRIPTION: Product applicability to say: Security decisions about applets are cached based on a non-cryptographic hash of the URL. An attacker can exploit collisions in these hashes to apply a user's previous security decision to a malicious site.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92493
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)