AusCERT - ESB-2012.0937 - [Win][Linux][HP-UX][Solaris][AIX] Rational Synergy: Multiple vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2012.0937 - [Win][Linux][HP-UX][Solaris][AIX] Rational Synergy: Multiple vulnerabilities
Date: 02 October 2012
References: ASB-2012.0024.2 ESB-2012.0915 ESB-2012.0926 ESB-2012.0944 ESB-2012.1040 ESB-2012.1044.2 ESB-2012.1189 ESB-2012.1194 ESB-2012.1214 ESB-2012.1217
ASB-2013.0007 ESB-2013.0220 ESB-2013.0221 ESB-2013.0470 ESB-2013.0473 ESB-2013.0651

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0937
             Multiple vulnerabilities in IBM Rational Synergy
                              2 October 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Rational Synergy
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Modify Arbitrary Files -- Remote with User Interaction
                   Denial of Service      -- Remote/Unauthenticated      
                   Cross-site Scripting   -- Remote with User Interaction
                   Unauthorised Access    -- Remote with User Interaction
                   Reduced Security       -- Unknown/Unspecified         
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-2161 CVE-2012-2159 CVE-2012-0507
                   CVE-2012-0506 CVE-2012-0505 CVE-2012-0503
                   CVE-2012-0502 CVE-2012-0501 CVE-2012-0500
                   CVE-2012-0499 CVE-2012-0498 CVE-2012-0497
                   CVE-2011-5035 CVE-2011-4461 CVE-2011-3563

Reference:         ASB-2012.0024.2
                   ESB-2012.0926
                   ESB-2012.0915

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21612331
   http://www-01.ibm.com/support/docview.wss?uid=swg21612332
   http://www-01.ibm.com/support/docview.wss?uid=swg21612333

Comment: This bulletin contains three (3) IBM security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Unspecified Vulnerabilities in Rational Synergy
(CVE-2012-0502,CVE-2012-0503,CVE-2012-0506,CVE-2012-0507,CVE-2011-3563,
CVE-2012-0500,CVE-2012-0497,CVE-2012-0498,CVE-2012-0499,CVE-2012-0500,
CVE-2012-0501,CVE-2012-0505,CVE-2011-5035)

Flash (Alert)

Abstract
Vulnerabilities in the Java Runtime Environment (JRE) 6 update 32 and earlier
component shipped with Rational Synergy may affect the security of the product.

Content

VULNERABILITY DETAILS:
CVE ID : CVE-2012-0502 (CVSS 6.4)

DESCRIPTION : Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect confidentiality and
availability, related to AWT.

References:
Complete CVSS Guide
CVE-2012-0502
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73193)


CVE ID : CVE-2012-0503 (CVSS 7.5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect confidentiality, integrity,
and availability, related to I18n.

References:
Complete CVSS Guide
CVE-2012-0503
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73191)


CVE ID : CVE-2012-0506 (CVSS 4.3)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect integrity via unknown vectors
related to CORBA.

References:
Complete CVSS Guide
CVE-2012-0506
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73196)


CVE ID : CVE-2012-0507 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote attackers to affect
confidentiality, integrity, and availability via unknown vectors related to
Concurrency. 

References:
Complete CVSS Guide
CVE-2012-0507
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72513)


CVE ID : CVE-2011-3563 (CVSS 6.4)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote attackers to affect
confidentiality and availability via unknown vectors related to Sound.

References:
Complete CVSS Guide
CVE-2011-3563
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73194)


CVE ID : CVE-2012-0500 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect confidentiality, integrity,
and availability via unknown vectors related to Deployment.

References:
Complete CVSS Guide
CVE-2012-0500
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73188)


CVE ID : CVE-2012-0497 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier, allows remote attackers to affect
confidentiality, integrity, and availability via unknown vectors related to 2D.

References:
Complete CVSS Guide
CVE-2012-0497
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73185)


CVE ID : CVE-2012-0498 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote attackers to affect
confidentiality, integrity, and availability via unknown vectors related to 2D.

References:
Complete CVSS Guide
CVE-2012-0498
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73186)


CVE ID : CVE-2012-0499 (CVSS 10)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote attackers to affect
confidentiality, integrity, and availability via unknown vectors related to 2D.

References:
Complete CVSS Guide
CVE-2012-0499
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73187)


CVE ID : CVE-2012-0501 (CVSS 5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote attackers to affect
availability via unknown vectors.

References:
Complete CVSS Guide
CVE-2012-0501
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73195)


CVE ID : CVE-2012-0505 (CVSS 7.5)

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE)
component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect confidentiality, integrity,
and availability via unknown vectors related to Serialization.

References:
Complete CVSS Guide
CVE-2012-0505
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/73192)


CVE ID : CVE-2011-5035 (CVSS 5)

DESCRIPTION: Rational Synergy computes hash values for form parameters without
restricting the ability to trigger hash collisions predictably, which allows
remote attackers to cause a denial of service (CPU consumption) by sending many
crafted parameters, aka Oracle security ticket S0104869.

References:
Complete CVSS Guide
CVE-2011-5035
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72015)



Affected Platforms: All Rational Synergy supported platforms

Remediation: Rational Synergy 7.2.0.X users should upgrade to Rational Synergy
version 7.2.0.3 (Rational Synergy 7.2.0.3) and Rational Synergy 7.1.0.X users
should move to Rational Synergy version 7.1.0.6 (Rational Synergy 7.1.0.6)

Workarounds: None known; apply fixes

Mitigation: Must upgrade to the new Rational Synergy releases as recommended.


*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST),
the Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF
ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY
ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines
Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

- -------------------------------------------------------------------------------

Security Bulletin: Potential Denial of Service (DoS) security vulnerability in
IBM Rational Synergy

Flash (Alert)

Abstract
Potential Denial of Service (DoS) security vulnerability in IBM Rational
Synergy due to a Java HashTable security vulnerability in Jetty
(CVE-2011-4461).

Content
VULNERABILITY DETAILS:
CVE ID: CVE-2011-4461

DESCRIPTION: IBM Rational Synergy is potentially vulnerable to Denial of
Service attacks because one of its embedded components, Jetty, has a security
vulnerability. The vulnerability is caused by insufficient randomization of
hash data structures. A remote attacker could exploit this vulnerability to
cause the consumption of CPU resources. Customers who are using IBM Rational
Synergy may be impacted by this Jetty vulnerability which can cause
performance or Denial of
Service (DoS) issues.

CVSS:
CVSS Base Score: 2
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/72017 for the
current score
CVSS Environmental Score*: Undefined 
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Platforms: All Rational Synergy supported platforms

Remediation: Rational Synergy 7.2.0.X users should upgrade to Rational Synergy
version 7.2.0.3 (Rational Synergy 7.2.0.3) and Rational Synergy 7.1.0.X users
should move to Rational Synergy version 7.1.0.6 (Rational Synergy 7.1.0.6) 

Workarounds: None known; apply fixes

Mitigation: Must upgrade to newer version of Rational Synergy as suggested
above

References:
Complete CVSS Guide
CVE-2011-4461
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/72017)

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST),
the Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF
ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY
ACTUAL OR POTENTIAL SECURITY VULNERABILITY.


Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines
Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

- -------------------------------------------------------------------------------

Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in
the Rational Synergy Help System (CVE-2012-2159, CVE-2012-2161)

Flash (Alert)

Abstract
Some scripts in the help system used by IBM Rational Synergy are vulnerable to
open redirect or cross-site scripting attacks. 

Content

VULNERABILITY DETAILS:

CVE ID: CVE-2012-2159

DESCRIPTION: Some scripts used by the help system are vulnerable to redirects
from trusted to untrusted web sites when users click a malicious link. 

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/74832 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)


CVE ID: CVE-2012-2161

DESCRIPTION: Some scripts used by the help system are vulnerable to cross-site
scripting attacks. An attacker could potentially exploit this vulnerability to
collect user credentials or cookie data when users click a malicious link. 

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/74833 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Platforms: Any supported Rational Synergy Web Help platform

Remediation: Upgrade to Rational Synergy version 7.2.0.3 (Rational Synergy
7.2.0.3)

Workarounds: Use Rational Synergy remote help which connects to the Rational
Synergy Information Center.

Mitigation: Do not trust URL links to the Rational Synergy Help system given by
untrusted users. Examine the URL for extra parameters and text that are not
related to the Rational Synergy Web Help system.

References:
Complete CVSS Guide
On-line Calculator V2
CVE-2012-2161
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/74832)
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/74833)

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST),
the Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF
ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY
ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines
Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUGqKqO4yVqjM2NGpAQJGbA//aitrrTvxdqcbl8qJXVnpRt4gaT3kLX5I
52ChQqKEFzcUvnhWvtqYGpPswcMej9uKLVXWPHBdRMXz2YkmTozOtIoa+yNdCJzO
oMb8PD4xSZIkjcVXQC3NPbD1lcu1hkUhz//w819TK8PN2dxB05tOno+0EAHmrpy9
OFq++i6205IXSnDB6XhE0kzwiFVYcG9E1xEPZ4WaSUfLXpCNpZSY1n9DQqwAYofa
YM95Vb6LEF+PmkJkXbFsEHE3JfWOM3GVnp0Bw6T4h9k2GEvyS3jVdiQVZyeY+HpE
2J2BiA3Ymu3chC0oFrmvsm48fB/vcQ8LKsjdM5qYvm4JbDLCjVVh8CtcJegWN+qo
uQwhLF7xG6x6GTMawITtLHPSBIpd+KAQoy1ryxOe2KoyMrOpY/tMe7HRkxp5v0U4
FmUqVjRq8UT+icnx7lYykVNE0aoNaobOW8lxr4+6ECQkJcRaECKb1+5BBfKmAelv
TIJQCB+JgjKcdODzQmR+Eh8mUgjHjkzSWiQvt4xvUjaUckCaf7Gry/G0rtThfnew
uL9xSVA667M9g7/208hwF8JJPAsRBKSyGqRbFC+9xeAsRRRyZG3N0e4w4qnHt+3b
Su8DyCLsX5L63CIEPYLLWg86g31WgBAbLnXwt/y7+o2B2B7FZITJlxtAOhX2GuI6
UrbXUX1bcfk=
=MBws
-----END PGP SIGNATURE-----