Security Bulletin: Security vulnerabilities in IBM Java Runtime affect IBM RLKS Administration and Reporting Tool Admin

Summary

There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM Rational License Key Server Administration and Reporting Tool Admin (ART).

Vulnerability Details

CVEID: CVE-2017-10115**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128876 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-10116**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128877 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

Affected Products and Versions

These vulnerabilities impact the following components and their releases:

• RLKS Administration and Reporting Tool version 8.1.4.9
• RLKS Administration and Reporting Tool version 8.1.5
• RLKS Administration and Reporting Tool version 8.1.5.1
• RLKS Administration and Reporting Tool version 8.1.5.2

Remediation/Fixes

For IBM RLKS Administration and Reporting Tool v. 8.1.5.x

Replace the JRE used in IBM RLKS Administration and Reporting Tool.

Steps to replace the JRE

1. Go to Fix Central.

2. Download the Java 8 runtime package that is applicable for your target platform.

3. Additionally, download the files US_export_policy.jar andlocal_policy.jar. **
**4. Shutdown RLKS Administration and Reporting Tool.

5. Go to the installation location of RLKS Administration and Reporting Tool.

6. Rename <install location>/jre folder to <install location>/jre_back. This step backs up the existing JRE.

7. Extract the downloaded JRE into <install location> folder.

8. Copy the downloaded US_export_policy.jar andlocal_policy.jar files to <install location>/jre/lib/security.

9. Startup RLKS Administration and Reporting Tool.

10. Login to the tool using rcladmin user and verify that you see the configured license servers under ‘Server’ tab.

For IBM RLKS Administration and Reporting Tool v. 8.1.4.9 or earlier

Upgrade to the latest version of 8.1.5.x. Then, update the JRE using the instructions mentioned above.

Workarounds and Mitigations

None