Security Bulletin: Multiple vulnerabilities in modules from the IBM SDK for Node.js affect the Cordova tools packaged in Rational Developer for i Modernization Tools Java Edition and Rational Developer for AIX and Linux (CVE-2014-7191 and CVE-2014-7192)

Summary

Security vulnerabilities have been discovered in the syntax-error and qs modules packaged in the IBM SDK for Node.js and Cordova platform packaged in Rational Developer for i Modernization Tools Java Edition and Rational Developer for AIX and Linux. The fix upgrades IBM SDK for Node.js to 1.1.0.9.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVEID: CVE-2014-7191

Description: Node.js is vulnerable to a denial of service, caused by an error in the qs module when parsing a string representing a deeply nested object. An attacker could exploit this vulnerability to block the event loop for an extended period of time and cause a denial of service.

CVSS Base Score: 5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96729&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-7192

Description: A vulnerability in the Node.js syntax-error module could allow a remote attacker to execute arbitrary code on the system, caused by the improper validation of input prior to being used in an eval() call. An attacker could exploit this vulnerability to inject and execute arbitrary script on the system.

CVSS Base Score: 7.5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96728&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Product Name

| Versions Affected
—|—
IBM Rational Developer for i, RPG and COBOL + Modernization Tools, Java Edition| 9.1
Rational Developer for AIX and Linux, AIX COBOL Edition| 9.1
Rational Developer for AIX and Linux, C/C++ Edition| 9.1

Remediation/Fixes

Update the product to the 9.1.1 level to address this vulnerability:

• Update the currently installed product using Installation Manager. ** **For instructions on installing this update using Installation Manager, review the topic Updating Installed Product Packages in the IBM Knowledge Center.

• Or, you can optionally download the update manually and apply Rational Developer for i 9.1.1
  Rational Developer for AIX and Linux, AIX COBOL Edition or C/C++ Edition| 9.1|

• For all client versions, update the currently installed product using Installation Manager. For instructions on installing this update using Installation Manager, review the topic Updating Installed Product Packages in the IBM Knowledge Center.

• For server updates or to manually download and apply the client updates see Rational Developer for AIX and Linux 9.1.1

Workarounds and Mitigations

None