Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager IP Edition (CVE-2018-1890, CVE-2019-2426)

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.1.1 and v4.2, which were disclosed in the Oracle January 2019 Critical Patch Update.

Vulnerability Details

CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/152081&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)

CVEID: CVE-2019-2426 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/155744&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Tivoli Network Manager IP Edition v4.1.1, v4.2

Remediation/Fixes

To update the Java Runtime Environment (JRE), complete the following steps.

1. Locate the appropriate IBM JRE for your operating system on the IBM Fix Central website.

• AIX: https://www-945.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=8.0.5.30-JavaTech-JavaSE-AIXpSeries64-ServiceRefresh5FP30&continue=1
• Linux: https://www-945.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=8.0.5.30-JavaTech-JavaSE-Linuxx86_6464-ServiceRefresh5FP30&continue=1
• zLinux: https://www-945.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=8.0.5.30-JavaTech-JavaSE-LinuxzSeries64-ServiceRefresh5FP30&continue=1

2. Download version 8.0.5.30 and install it.
3. Back up the directory $NCHOME/precision/jre.
4. Stop all running processes of the Network Manager Core Components and Apache Storm by using the itnm_stop command.
5. Delete the contents of the $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib directory.
6. Copy the contents of the bin and lib directories from the JRE that you installed in step 2 to $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib, respectively.
7. Restart the Network Manager Core Components and Apache Storm by using the itnm_start command.

To upgrade or rollback the Network Manager Core Components, restore the backup that you made in step 3. Perform the upgrade or rollback, then perform steps 4 to 7 again.

Workarounds and Mitigations

None