Security Bulletin: Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct for Microsoft Windows

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Version 7 and 8 used by IBM Sterling Connect:Direct for Microsoft Windows. The issue was disclosed as part of the IBM Java SDK updates in January 2018.

Vulnerability Details

CVEID: CVE-2018-2602 DESCRIPTION: An unspecified vulnerability related to the Java SE I18n component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 4.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/137854 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM Sterling Connect:Direct for Microsoft Windows 4.7.0.0 through 4.7.0.5_iFix015
IBM Sterling Connect:Direct for Microsoft Windows 4.8.0.0 through 4.8.0.0_iFix005

Remediation/Fixes

Product

| VRMF |APAR|Remediation/First Fix
—|—|—|—
IBM Sterling Connect:Direct for Microsoft Windows | 4.7.0 | IT25318 | 4.7.0.5_iFix016, available on Fix Central
IBM Sterling Connect:Direct for Microsoft Windows | 4.8.0 | IT25318 | 4.8.0.0_iFix006, available on Fix Central

For older versions/releases IBM recommends upgrading to a fixed, supported version/release of the product.

Workarounds and Mitigations

None