Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by Open Source Tomcat vulnerability

Summary

WebSphere Message Broker and IBM Integration Bus are affected by Open Source Apache Tomcat vulnerability

Vulnerability Details

CVEID: CVE-2016-6816**
DESCRIPTION:** Apache Tomcat is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
CVSS Base Score: 6.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119158 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

IBM Integration Bus V10.0.0.0- 10.0.0.8

IBM Integration Bus V9.0.0.0- 9.0.0.7

WebSphere Message Broker V8.0.0.0 - 8.0.0.8

Remediation/Fixes

Product

| VRMF|APAR|Remediation/Fix
—|—|—|—
IBM Integration Bus| V10.0.0.0- 10.0.0.8| IT19472 | The APAR is available in fix pack 10.0.0.9

<http://www-01.ibm.com/support/docview.wss?uid=swg24043686&gt;

IBM Integration Bus| V9.0.0.0- 9.0.0.7| IT19472 | The APAR is available in fix pack 9.0.0.8

<http://www-01.ibm.com/support/docview.wss?uid=swg24043751&gt;

WebSphere Message Broker| V8.0.0.0 - 8.0.0.8| IT19472 | The APAR is available in fix pack 8.0.0.9

https://www.ibm.com/support/docview.wss?uid=swg24043806

For unsupported versions of the product, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :

http://www.ibm.com/support/docview.wss?rs=849&uid=swg27006308

Workarounds and Mitigations

None known