Security Bulletin: A vulnerability in Apache Ant affects IBM InfoSphere Information Server

Summary

A vulnerability in Apache Ant was addressed by IBM InfoSphere Information Server.

Vulnerability Details

CVEID: CVE-2012-2098 DESCRIPTION: Apache Commons Compress and Apache Ant are vulnerable to a denial of service, caused by an error when using bzip2 compression to compress files. By passing specially-crafted input to the BZip2CompressorOutputStream class, a remote attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 5
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/75857&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

The following product, running on all supported platforms, is affected:
IBM InfoSphere Information Server: versions 11.3, 11.5, and 11.7
IBM InfoSphere Information Server on Cloud: versions 11.5, and 11.7

Remediation/Fixes

Product

| VRMF | APAR | Remediation/First Fix
—|—|—|—
InfoSphere Information Server, Information Server on Cloud | 11.7 | JR60963 | --Apply IBM InfoSphere Information Server version 11.7.1.0
--Apply IBM InfoSphere Information Server 11.7.1.0 Service Pack 1

InfoSphere Information Server, Information Server on Cloud | 11.5 |

JR60963

JR61551

| --Apply InfoSphere Information Server version 11.5.0.2
--Apply InfoSphere Information Server 11.5.0.2 Service Pack 6
--Apply InfoSphere Information Server Framework Security patch
--Apply InfoSphere Metadata Asset Manager Security patch
--Apply InfoSphere Governance Catalog Security patch
--Apply InfoSphere Component Installer Security patch
--Apply InfoSphere Common Metadata Services Security patch
InfoSphere Information Server | 11.3 | JR60963 | --Upgrade to a new release where the issue has been addressed

Contact Technical Support:

In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.

Workarounds and Mitigations

None