AusCERT - ESB-2013.0621 - [Win][Linux][HP-UX][Solaris][AIX] Tivoli Federated Identity Manager Business Gateway: Denial of service

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2013.0621 - [Win][Linux][HP-UX][Solaris][AIX] Tivoli Federated Identity Manager Business Gateway: Denial of service - Remote/unauthenticated
Date: 02 May 2013
References: ASB-2012.0143 ASB-2012.0144 ESB-2013.0432 ESB-2013.0437 ESB-2013.0653

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2013.0621
 Security Bulletin: IBM Tivoli Federated Identity Manager Business Gateway
          can be affected by a vulnerability in IBM Java Runtime
                        Environment (CVE-2012-5081)
                                2 May 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Tivoli Federated Identity Manager Business Gateway
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
                   z/OS
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-5081  

Reference:         ESB-2013.0437
                   ESB-2013.0432
                   ASB-2012.0144
                   ASB-2012.0143

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21621887

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM Tivoli Federated Identity Manager Business Gateway can 
be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Document information
Tivoli Federated Identity Manager Business Gateway

Software version:
6.1.1, 6.2, 6.2.1, 6.2.2

Operating system(s):
AIX, HP-UX, Linux, Solaris, Windows, z/OS

Reference #:
1621887

Modified date:
2013-04-26

Abstract

A vulnerability in the Java Runtime Environment (JRE) impacts IBM Tivoli 
Federated Identity Manager Business Gateway

Content

VULNERABILITY DETAILS:

DESCRIPTION: 
An unspecified vulnerability in the Java Runtime Environment (JRE) component 
allows remote attackers to affect availability, related to JSSE. 

The attack does not require local network access nor does it require 
authentication, but some degree of specialized knowledge and techniques are 
required. An exploit would not impact the confidentiality of information or 
the integrity of data, but the availability of the system could be compromised. 

CVEID: CVE-2012-5081
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79435 for the 
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)



AFFECTED PRODUCTS AND VERSIONS: 

Tivoli Federated Identity Manager Business Gateway versions 6.1.1, 6.2.0, 
6.2.1, 6.2.2


REMEDIATION: 
The remediation depends on the version of WebSphere you are using. There are 
two alternatives. 

Alternative 1) If you are using the eWAS bundled with Tivoli Federated Identity
Manager (this was only avaliable for FIM versions 6.1.1 or higher), you will 
need to apply the patch for IBM Java 5 SR 15. This is available at the 
following link:
http://www-01.ibm.com/support/docview.wss?uid=swg24033932

Alternative 2) If you are using a separate WebSphere installation instead of 
the eWAS bundled with Tivoli Federated Identity Manager, please see the 
following advisory to determine how to patch your WebSphere version:
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D600&uid=swg21617227&loc=en_US&cs=utf-8



Workaround(s): 
None

Mitigation(s): 
None

REFERENCES: 
Complete CVSS Guide
On-line Calculator V2
CVE-2012-5081
http://xforce.iss.net/xforce/xfdb/79435


RELATED INFORMATION: 
IBM Secure Engineering Web Portal 


*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of 
this vulnerability in their environments by accessing the links in the 
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), 
the Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUYIWDu4yVqjM2NGpAQKLsA//ZIgn2usM+aLAETam74pmV4oFyJfw9VHv
atPYa2qiAPlSt1Gu2aS3Xz38wsewHBd46HCeAv60KG/wO6CWDyIzx1uQ7/dg+8Le
8l/rhEnUres+jJgFgRTKy3Djj9q4jKmV89+7Fq/2c7QoI+6zCQnfncrcrLT29peZ
UOVzFTYW0t5WJRvfRSTXb1nC+hnmZ1HGWToEloEiymwCOxKOkrPZhY6TB86fM2Ge
5D0kUyWAV1eZNzZYIBBevjfVk4xn99nbbqTFzMkMBunxyCiC2qyk7WJI/NA/t8zR
HRLmWO5ZAfQqt2geuWTAttDePy5OQqt1WVDQU5FPHAERwrqSVy+rxnOn+Br+mqbF
18tOpT7sZoVdLZB8narzuzFTmoKquImGkESGnRFPgngP1TPrzf3XLiHhaEbpQfhA
5glbBZyTYRoDRZU6yACUleJjsClZLWgF2frMC3QHwMUjyWLdPFJX6xPXFAZmnNlc
ixR4jwP2rxlYV74Rd4p6xe4qmEkHsS/8NwVwLCOS3EUzqiAVAxYgXzfD3ZUYD1Jw
M5z6y6oxwRFnV0VTFSMeqEqjCVfUS3CkCpv74C1Al5LIMe54FfbyA8iZb8XPz0Iv
/ptbOozGcvK6YrzykzcTvNXY45KlCFLsEe6WsxXUiQWlnTll2HY62uhHzr/VvwnF
J328b2TW7P4=
=0S7f
-----END PGP SIGNATURE-----