10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.948 High
EPSS
Percentile
99.3%
IBM SECURITY ADVISORY
First Issued: Wed Jun 3 12:58:42 CDT 2015
|Updated: Wed Jun 3 16:10:11 CDT 2015
|Update: Corrected affected fileset levels
The most recent version of this document is available here:
http://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc
https://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc
ftp://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX
CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480
CVE-2015-0486 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808
CVE-2015-1916 CVE-2015-1914 CVE-2015-0192 CVE-2015-0204
===============================================================================
SUMMARY:
There are multiple vulnerabilities in IBM SDK Java Technology Edition,
Versions 5, 6, 7, 7.1 that are used by AIX. These issues were disclosed as
part of the IBM Java SDK updates in April 2015.
This bulletin also addresses FREAK: Factoring Attack on RSA-EXPORT keys'
SSL/TLS vulnerability and RC4 Bar Mitzvah Attack for SSL/TLS vulnerability.
===============================================================================
VULNERABILITY DETAILS:
CVE-2015-0204 was fixed in IBM SDK, Java Technology Edition under
CVE-2015-0138. Both CVEs are included in this advisory for completeness.
CVEID: CVE-2015-0491
DESCRIPTION: An unspecified vulnerability related to the 2D component has
complete confidentiality impact, complete integrity impact, and
complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102329 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0459
DESCRIPTION: An unspecified vulnerability related to the 2D component has
complete confidentiality impact, complete integrity impact, and
complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102328 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0469
DESCRIPTION: An unspecified vulnerability related to the 2D component has
complete confidentiality impact, complete integrity impact, and
complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102327 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0458
DESCRIPTION: An unspecified vulnerability related to the Deployment
component has complete confidentiality impact, complete integrity
impact, and complete availability impact.
CVSS Base Score: 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102332 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVEID: CVE-2015-0480
DESCRIPTION: A directory traversal vulnerability related to the Tools
component and the extraction of JAR archive files could allow remote
attacker to overwrite files on the system with privileges of another
user.
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102334 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVEID: CVE-2015-0488
DESCRIPTION: An unspecified vulnerability related to the JSSE component
could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102336 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0478
DESCRIPTION: An unspecified vulnerability related to the JCE component
could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102339 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-0477
DESCRIPTION: An unspecified vulnerability related to the Beans component
has no confidentiality impact, partial integrity impact, and no
availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102337 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVEID: CVE-2015-0204
DESCRIPTION: A vulnerability in the OpenSSL ssl3_get_key_exchange
function could allow a remote attacker to downgrade the security of
certain TLS connections. An OpenSSL client accepts the use of an RSA
temporary key in a non-export RSA key exchange ciphersuite. This
could allow a remote attacker using man-in-the-middle techniques to
facilitate brute-force decryption of TLS/SSL traffic between
vulnerable clients and servers. This vulnerability is also known as
the FREAK attack.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99707 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVEID: CVE-2015-0192
DESCRIPTION: A vulnerability in the IBM implementation of the Java
Virtual Machine may, under limited circumstances, allow untrusted
code running under a security manager to elevate its privileges.
CVSS Base Score: 6.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101008 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVEID: CVE-2015-0486
DESCRIPTION: An unspecified vulnerability related to the Deployment
component could allow a remote attacker to obtain sensitive
information.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102335 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-2808
DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL
protocol, could allow a remote attacker to obtain sensitive
information. An attacker could exploit this vulnerability to remotely
expose account credentials without requiring an active
man-in-the-middle session. Successful exploitation could allow an
attacker to retrieve credit card data or other sensitive information.
This vulnerability is commonly referred to as "Bar Mitzvah Attack".
CVSS Base Score: 5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/101851
for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-1916
DESCRIPTION: Server applications which use the IBM Java Secure Socket
Extension provider to accept SSL/TLS connections are vulnerable to a
denial of service attack due to an unspecified vulnerability.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101995 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-1914
DESCRIPTION: A vulnerability in the IBM implementation of the Java Virtual
Machine may allow untrusted code running under a security manager to
bypass permission checks and view sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101908 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVEID: CVE-2015-0138
DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could
allow a remote attacker to downgrade the security of certain SSL/TLS
connections. An IBM SSL/TLS client implementation could accept the use
of an RSA temporary key in a non-export RSA key exchange ciphersuite.
This could allow a remote attacker using man-in-the-middle techniques
to facilitate brute-force decryption of TLS/SSL traffic between
vulnerable clients and servers. This vulnerability is also known as the
FREAK attack.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100691 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED PRODUCTS AND VERSIONS:
AIX 5.3, 6.1, 7.1
VIOS 2.2.x
The following fileset levels (VRMF) are vulnerable, if the
respective Java version is installed:
For Java5: Less than 5.0.0.600
For Java6: Less than 6.0.0.480
For Java7: Less than 7.0.0.205
For Java7.1: Less than 7.1.0.85
Note: to find out whether the affected Java filesets are installed
on your systems, refer to the lslpp command found in AIX user's guide.
Example: lslpp -L | grep -i java
REMEDIATION:
IBM SDK, Java Technology Edition, Version 5.0 Service Refresh 16
Fix Pack 10 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+64-bit,+pSeries&function=all
IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix
Pack 4 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+64-bit,+pSeries&function=all
IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 and
subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+64-bit,+pSeries&function=all
IBM SDK, Java Technology Edition, Version 7.1 Service Refresh 3 and
subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+64-bit,+pSeries&function=all
WORKAROUNDS AND MITIGATIONS:
None.
===============================================================================
CONTACT US:
If you would like to receive AIX Security Advisories via email,
please visit "My Notifications":
http://www.ibm.com/support/mynotifications
To view previously issued advisories, please visit:
http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq
Comments regarding the content of this announcement can be
directed to:
[email protected]
To obtain the OpenSSL public key that can be used to verify the
signed advisories and ifixes:
Download the key from our web page:
http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt
To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team via [email protected] you
can either:
A. Download the key from our web page:
http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt
B. Download the key from a PGP Public Key Server. The key ID is:
0x28BFAA12
Please contact your local IBM AIX support center for any
assistance.
REFERENCES:
Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2:
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
IBM Java SDK Security Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg21883640
ACKNOWLEDGEMENTS:
CVE-2015-1916 and CVE-2015-0138 were reported to IBM by Karthikeyan
Bhargavan of the PROSECCO team at INRIA
CHANGE HISTORY:
First Issued: Wed Jun 3 12:58:42 CDT 2015
| Updated: Wed Jun 3 16:10:11 CDT 2015
| Update: Corrected affected fileset levels
===============================================================================
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an “industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.