Security Bulletin: Security vulnerabilities in Apache Tomcat affects multiple IBM Rational products based on IBM's Jazz technology (CVE-2014-0227)

Summary

The Jazz Team Server is shipped with a version of the Apache Tomcat web server which contains security vulnerabilities that could potentially impact the following IBM Rational products deployed on Apache Tomcat: Collaborative Lifecycle Management (CLM), Rational Requirements Composer (RRC), Rational DOORS Next Generation (RDNG), Rational Engineering Lifecycle Manager (RELM), Rhapsody Design Manager (Rhapsody DM), Rational Software Architect Design Manager (RSA DM), Rational Team Concert (RTC), and Rational Quality Manager (RQM).

Vulnerability Details

IBM Jazz Team Server applications are shipped with an Apache Tomcat web server. Apache Tomcat released new versions which contain security vulnerability fixes.

IBM Jazz Team Server may be deployed on either IBM WebSphere Application Server (WAS) or Apache Tomcat. These vulnerabilities are for deployments deployed on Apache Tomcat only. Deployments using WAS are not vulnerable.

CVEID: CVE-2014-0227**
DESCRIPTION:** Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed chunked header to the Web server to cause multiple processing conflicts on the servers. An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100751&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

Rational Collaborative Lifecycle Management 3.0.1 - 5.0.2

Rational Quality Manager 2.0 - 2.0.1
Rational Quality Manager 3.0 - 3.0.1.6
Rational Quality Manager 4.0 - 4.0.7
Rational Quality Manager 5.0 - 5.0.2

Rational Team Concert 2.0 - 2.0.0.2
Rational Team Concert 3.0 - 3.0.6
Rational Team Concert 4.0 - 4.0.7
Rational Team Concert 5.0 - 5.0.2

Rational Requirements Composer 2.0 - 2.0.0.4
Rational Requirements Composer 3.0 - 3.0.1.6
Rational Requirements Composer 4.0 - 4.0.7

Rational DOORS Next Generation 4.0 - 4.0.7
Rational DOORS Next Generation 5.0 - 5.0.2

Rational Engineering Lifecycle Manager 1.0- 1.0.0.1
Rational Engineering Lifecycle Manager 4.0.3 - 4.0.7
Rational Engineering Lifecycle Manager 5.0 - 5.0.2

Rational Rhapsody Design Manager 3.0 - 3.0.1
Rational Rhapsody Design Manager 4.0 - 4.0.7
Rational Rhapsody Design Manager 5.0 - 5.0.2

Rational Software Architect Design Manager 3.0 - 3.0.1
Rational Software Architect Design Manager 4.0 - 4.0.7
Rational Software Architect Design Manager 5.0 - 5.0.2

Remediation/Fixes

Upgrade your products to version 3.0.1.6 or4.0.7or5.0.2, apply the latest ifix, and then perform the following upgrades:

Note: The fixes are in Apache Tomcat version 7.0.59 or later. Perform How to update the Apache Tomcat server for IBM Rational products based on versions 3.0.1.6, 4.0.7 or later of IBM’s Jazz technology to apply the remediation.

• For the 3.x releases of Rational Software Architect Design Manager and Rhapsody Design Manager, if you cannot upgrade to 4.0.7 or 5.0, contact IBM support for guidance.

• For the 2.x releases, contact IBM support for additional details on the fix.

• For the 1.x releases of Rational Engineering Lifecycle Manager, contact IBM support for additional details on the fix.

Workarounds and Mitigations

None