-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0302
  Potential Security Vulnerabilities in IBM WebSphere Application Server
                               21 March 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM WebSphere Application Server
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Modify Arbitrary Files -- Existing Account            
                   Denial of Service      -- Remote/Unauthenticated      
                   Cross-site Scripting   -- Remote with User Interaction
                   Unauthorised Access    -- Remote/Unauthenticated      
                   Reduced Security       -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-0720 CVE-2012-0717 CVE-2012-0716
                   CVE-2012-0193 CVE-2011-4889 CVE-2011-1376

Reference:         ESB-2012.0061

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21587015&myns=swgws&mynp=OCSS7K4U&mynp=OCSSEQTP&mynp=OCSSEQTJ&mync=E

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Potential Security Vulnerabilities in IBM WebSphere 
Application Server

WebSphere Application Server

General

Software version:
6.1, 7.0, 8.0

Operating system(s):
AIX, HP-UX, IBM i, Linux, Solaris, Windows, i5/OS, z/OS

Software edition:
Base, Developer, Express, Network Deployment

Reference #:
1587015

Modified date:
2012-03-19

Flash (Alert)

Abstract

Cross reference list for security vulnerabilities included in WebSphere 
Application Server Fix Pack 6.1.0.43

Content

VULNERABILITY DETAILS:
CVE ID: CVE-2011-1376 (PM49712)

DESCRIPTION: IBM Websphere Application Server, when running on IBM i operating 
systems, applies insecure permissions to files in the 
$WAS_HOME/systemapps/isclite.ear and $WAS_HOME/bin/client_ffdc directories via
the iscdeploy script following fix pack installation. A local attacker could 
exploit this vulnerability to read or write to affected files.

CVSS:

CVSS Base Score: 4.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/71230 for the 
current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:L/AC:M/Au:N/C:P/I:P/A:P)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for IBM i 
operating systems, Versions are affected:
 Version 8
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack for each named 
product as soon as practical

Fix:
Refer to FLASH http://www.ibm.com/support/docview.wss?uid=swg21569205 for more 
information or Apply a PTF containing this APAR PM49712, as noted below:

For IBM WebSphere Application Server :

For V8.0 through 8.0.0.1:
o Install PTF that contains Fix Pack 2 (8.0.0.2), or later.

For V7.0 through 7.0.0.19:
o Install PTF that contains Fix Pack 21 (7.0.0.21), or later

For V6.1.0 through 6.1.0.41:
o Install PTF that contains Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): None



CVE ID: CVE-2011-4889 (PM52049)

DESCRIPTION: The IBM WebSphere Application Server Virtual Member Manager could 
provide weaker than expected security, caused by an error in the 
javax.naming.directory.AttributeInUseException class when updating passwords on
a configuration using IBM Tivoli Directory Server. A remote attacker could 
exploit this vulnerability to log into an application using an old password 
that has been changed.

CVSS:

CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/72581 for the 
current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for 
distributed operating systems, IBM i operating systems, and z/OS operating 
system Versions are affected:
 Version 8
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack for each named 
product as soon as practical

Fix:
Apply a Fix Pack or PTF containing this APAR PM52049, as noted below:

For IBM WebSphere Application Server :

For V8.0 through 8.0.0.1:
o Install Fix Pack 2 (8.0.0.2), or later.

For V7.0 through 7.0.0.19:
o Install Fix Pack 21 (7.0.0.21), or later

For V6.1.0 through 6.1.0.41:
o Install Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): none.



CVE ID: CVE-2012-0720 (PM52274)

DESCRIPTION: WebSphere Application Server Administration Console is vulnerable 
to cross-site scripting, caused by improper validation of user-supplied input 
by the Administrative Console. A remote attacker could exploit this 
vulnerability using unspecified attack vectors to inject script in a victims 
Web browser within the security context of the hosting Web site.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: Seehttp://xforce.iss.net/xforce/xfdb/74044 for the current 
score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for 
distributed operating systems, IBM i operating systems, and z/OS operating 
system Versions are affected:
 Version 8
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each 
named product as soon as practical

Fix:
Apply a Fix Pack or PTF containing this APAR PM52274, as noted below:

For IBM WebSphere Application Server

For V8.0 through 8.0.0.2:
o Install Fix Pack 3 (8.0.0.3), or later (targeted to be available 16 April 
2012).

For V7.0 through 7.0.0.21:
o Install Fix Pack 23 (7.0.0.23), or later (targeted to be available 28 May 
2012).

For V6.1.0 through 6.1.0.41:
o Install Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): When you have the Administrator Console open, do not use your 
 web browser to visit other websites. Open another web browser to visit other
 websites.



CVE ID: CVE-2012-0717 (PM52351)

DESCRIPTION:
WebSphere Application Server could allow a remote attacker to bypass SSL client 
certificate authentication in IBM HTTP Server when ALL of the following 
conditions are true in the same SSL enabled virtual host:
 SSL is enabled with SSLEnable (not enabled by default)
 SSL Client Authentication is enabled with SSLClientAuth required_reset (not 
enabled by default, SSLClientAuth required not affected
 SSLv2 has not been disabled with SSLProtocolDisable SSLv2
 SSLClientAuthRequire is not configured

CVSS:

CVSS Base Score: 2.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/73749 for the 
current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for 
distributed operating systems, IBM i operating systems, and z/OS operating 
system Versions are affected:
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack for each named 
product as soon as practical

Fix:
Apply a Fix Pack or PTF containing this APAR PM52351, as noted below:

For IBM WebSphere Application Server :

For V7.0 through 7.0.0.21:
o Install Fix Pack 23 (7.0.0.23), or later (targeted to be available 28 May 
2012).

For V6.1.0 through 6.1.0.41:
o Install Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): Disable SSLv2 is the preferred method, but any other option in 
 the description list above can be changed instead.



CVE ID: CVE-2012-0716 (PM53132)

DESCRIPTION: WebSphere Application Server Administration Console is vulnerable 
to cross-site scripting, caused by improper validation of user-supplied input 
by the Administrative Console. A remote authenticated attacker could exploit 
this vulnerability using unspecified attack vectors to inject script in a 
victims Web browser within the security context of the hosting Web site.

CVSS:

CVSS Base Score: 4.3
CVSS Temporal Score: Seehttp://xforce.iss.net/xforce/xfdb/73748 for the current 
score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for 
distributed operating systems, IBM i operating systems, and z/OS operating 
system Versions are affected:
 Version 8
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each 
named product as soon as practical

Fix:
Apply a Fix Pack or PTF containing this APAR PM53132, as noted below:

For IBM WebSphere Application Server :

For V8.0 through 8.0.0.2:
o Install Fix Pack 3 (8.0.0.3), or later (targeted to be available 16 April 
2012).

For V7.0 through 7.0.0.21:
o Install Fix Pack 23 (7.0.0.23), or later (targeted to be available 28 May 
2012).

For V6.1.0 through 6.1.0.41:
o Install Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): When you have the Administrator Console open, do not use the 
web browser to visit other websites. Open another web browser to visit other 
websites.



CVE ID: CVE-2012-0193 (PM53930)

DESCRIPTION: WebSphere Application Server is vulnerable to a denial of service, 
caused by insufficient randomization of Java hash data structures. By sending 
multiple specially-crafted HTTP POST requests to an affected application 
containing conflicting hash key values, a remote attacker could exploit this 
vulnerability to cause the consumption of CPU resources.

CVSS:

CVSS Base Score: 5
CVSS Temporal Score: See [insert link to supporting entry in the X-Force 
Database] for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

AFFECTED PLATFORMS: The following IBM WebSphere Application Server for 
distributed operating systems, IBM i operating systems, and z/OS operating 
system Versions are affected:
 Version 8
 Version 7
 Version 6.1

REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each 
named product as soon as practical

Fix:
Refer to FLASH http://www.ibm.com/support/docview.wss?uid=swg21577532 for more 
information or
Apply a Fix Pack or PTF containing this APAR PM53930, as noted below:

For IBM WebSphere Application Server :

For V8.0 through 8.0.0.2:
o Install Fix Pack 3 (8.0.0.3), or later (targeted to be available 16 April 
2012).

For V7.0 through 7.0.0.21:
o Install Fix Pack 23 (7.0.0.23), or later (targeted to be available 28 May 
2012).

For V6.1.0 through 6.1.0.41:
o Install Fix Pack 43 (6.1.0.43), or later.

 Workaround(s): None

 Mitigation(s): none


REFERENCES:
 Complete CVSS Guide http://www.first.org/cvss/cvss-guide.html
 On-line Calculator V2 http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2



CHANGE HISTORY:
 19 March 2012: Original copy published

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of 
this vulnerability in their environments by accessing the links in the 
Reference section of this Flash.


Note: According to the Forum of Incident Response and Security Teams (FIRST), 
the Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment 	
Product 	Application Servers
Component 	WebSphere Application Server for z/OS
Platform 	General	z/OS, OS/390
Version 	8.0, 7.0, 6.1
Edition

Product		Application Servers
Component	IBM HTTP Server	SSL
Platform	AIX, HP-UX, IBM i, Linux, Solaris, Windows, z/OS
Version		8.0, 7.0, 6.1
Edition		All Editions

Copyright and trademark information

IBM, the IBM logo and ibm.com are trademarks of International Business Machines 
Corp., registered in many jurisdictions worldwide. Other product and service 
names might be trademarks of IBM or other companies. A current list of IBM 
trademarks is available on the Web at "Copyright and trademark information" at 
www.ibm.com/legal/copytrade.shtml.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT2k6me4yVqjM2NGpAQK5GhAArIkbs6uTbQ0FDDAjvvzeNkSfJ0zzfNmi
jGpf9bIJoFtGY7Mc0HrlCO1l4lodzfP95BFQn/fG9Qoa4rmcTu6OwnlpDgx5yBvi
47oXsRVQBPSz83CzaFM0uv12YjANozkG1k0yodomSGff7naweOTGJ8VjXix5g7yj
fsTkrYD6ygpVpeftSLCYl5o6AaThU8KOMtYcduZO7v/lDtg/rxftkFZ1NgHqZ9Db
Tb7ZW6Lo0leZ6WItUyzh+lqSbhPQ0ZI0caNsWy3Hb1ZktZ73DB70MMJBu+Dg3mVu
xHzSnArYtmrdpPH6rwqMH1ToId8HtpZ8pLRN5UoCAuy5C6PjDrrzslbo74NDJZly
RB7xaG+tJdY5RTQ6W1AJ79EBjslpVbxHblJIyVKFoMFGcylO0EgM3P4zlBeoOLda
kEk45k2gwc/7LRLtr/4aK5ADYTcOjyuUCYQ5TGzFK/aEcyIiqAGX16UFa2n98zXY
7EvPrppp/rq/RluehVC2RNu9a/v1pfBvU9QpVtOeTblbm/Xxvi+QMeeM1o9ZbeGy
y28G6eNjYGFrC6xdMVC+8Wa1N2M/NkZ2s9rFEfLkCrOZP+FZK6/DoZi8YOr5No9m
vriXG/0M/CdhwPDOfa3lFIYx8+gfT99sG6Zqf2Gq9H1teYv4JVWSbF2dl9v8v1J3
a4H2KvjOShQ=
=vWJ6
-----END PGP SIGNATURE-----