ESB-2017.1853 - [Win][Linux][Solaris][AIX] IBM InfoSphere Master Data Management: Multiple vulnerabilities 2017-07-28

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.1853
        Multiple vulnerabilities have been identified in InfoSphere
                          Master Data Management
                               28 July 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM InfoSphere Master Data Management
Publisher:         IBM
Operating System:  AIX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Access Privileged Data          -- Remote/Unauthenticated      
                   Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Modify Arbitrary Files          -- Remote/Unauthenticated      
                   Cross-site Request Forgery      -- Remote with User Interaction
                   Denial of Service               -- Remote/Unauthenticated      
                   Cross-site Scripting            -- Existing Account            
                   Provide Misleading Information  -- Existing Account            
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-3732 CVE-2017-3731 CVE-2017-3730
                   CVE-2017-3544 CVE-2017-3539 CVE-2017-3533
                   CVE-2017-3526 CVE-2017-3514 CVE-2017-3512
                   CVE-2017-3511 CVE-2017-3509 CVE-2017-1289
                   CVE-2016-9843 CVE-2016-9842 CVE-2016-9841
                   CVE-2016-9840 CVE-2016-9719 CVE-2016-9718
                   CVE-2016-9717 CVE-2016-9716 CVE-2016-9715
                   CVE-2016-9714 CVE-2016-7055 

Reference:         ASB-2017.0123
                   ASB-2017.0115
                   ASB-2017.0113
                   ESB-2017.0055
                   ESB-2016.2841
                   ESB-2016.2770

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=swg22006605
   http://www.ibm.com/support/docview.wss?uid=swg22006606
   http://www.ibm.com/support/docview.wss?uid=swg22006610
   http://www.ibm.com/support/docview.wss?uid=swg22006611
   http://www.ibm.com/support/docview.wss?uid=swg22006608
   http://www.ibm.com/support/docview.wss?uid=swg22006607
   http://www.ibm.com/support/docview.wss?uid=swg22006602
   http://www.ibm.com/support/docview.wss?uid=swg22006603

Comment: This bulletin contains eight (8) IBM security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable
to HTTP Parameter Override discovered in MDM User Interface (CVE-2016-9717)

Document information

More support for: InfoSphere Master Data Management

Software version: 10.1, 10.1.0, 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006605

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to a HTTP Parameter
Override which may produce an anomalous behavior in the application that
can be potentially exploited .

Vulnerability Details

CVEID: CVE-2016-9717
DESCRIPTION: HTTP Parameter Override is identified in IBM Infosphere Master
Data Management (MDM) product. It enables attackers by exposing the presence
of duplicated parameters which may produce an anomalous behavior in the
application that can be potentially exploited.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119730 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM InfoSphere Master Data Management Server	Affected Versions
IBM InfoSphere Master Data Management			10.1
IBM InfoSphere Master Data Management			11.0
IBM InfoSphere Master Data Management			11.3
IBM InfoSphere Master Data Management			11.4
IBM InfoSphere Master Data Management			11.5
IBM InfoSphere Master Data Management			11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix
Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------

Security Bulletin: IBM InfoSphere Master Data Management Server is
vulnerable to Insecure HTTP Method - TRACE discovered in MDM User Interface
(CVE-2016-9718)

Document information

More support for: InfoSphere Master Data Management

Software version: 10.1, 10.1.0, 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006606

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to a cross-site
scripting Attack and could allow users to embed arbitrary JavaScript code
in MDM User Interfaces and lead to disclosure of credentials.

Insecure HTTP Method - TRACE discovered in MDM User Interface affects
Inspector and Web Reports in IBM InfoSphere Master Data Management.

Vulnerability Details

CVEID: CVE-2016-9718
DESCRIPTION: IBM InfoSphere Master Data Management Server is vulnerable to
cross-site scripting. This vulnerability allows users to embed arbitrary
JavaScript code in the Web UI thus altering the intended functionality
potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 4.6
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119732 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM InfoSphere Master Data 	Affected Versions
Management Server

IBM InfoSphere Master Data Management	10.1
IBM InfoSphere Master Data Management	11.0
IBM InfoSphere Master Data Management	11.3
IBM InfoSphere Master Data Management	11.4
IBM InfoSphere Master Data Management	11.5
IBM InfoSphere Master Data Management	11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix
Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------
Security Bulletin: IBM InfoSphere Master Data Management Server is
vulnerable to a Cross Site Request Forgery discovered in MDM User Interface
(CVE-2016-9716)

Document information

More support for: InfoSphere Master Data Management

Software version: 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006610

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management Server is vulnerable to a Cross
Site Request Forgery which could allow an attacker to execute malicious
and unauthrized actions.

Vulnerability Details

CVEID: CVE-2016-9716
DESCRIPTION: IBM InfoSphere Master Data Management Server is vulnerable to
cross-site request forgery which could allow an attacker to execute malicious
and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119729 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM InfoSphere Master Data 	Affected Versions
Management Server

IBM InfoSphere Master Data Management	11.0
IBM InfoSphere Master Data Management	11.3
IBM InfoSphere Master Data Management	11.4
IBM InfoSphere Master Data Management	11.5
IBM InfoSphere Master Data Management	11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix
Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable
to cross-site scripting Attack (CVE-2016-9715)

Document information

More support for: InfoSphere Master Data Management

Software version: 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006611

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to a cross-site
scripting Attack and could allow users to embed arbitrary JavaScript code
in the Web UI and lead to disclosure of credentials.

Vulnerability Details

CVEID: CVE-2016-9715
DESCRIPTION: IBM InfoSphere Master Data Management Server is vulnerable to
cross-site scripting. This vulnerability allows users to embed arbitrary
JavaScript code in the Web UI thus altering the intended functionality
potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119728 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:
Affected IBM InfoSphere Master Data Management Server

Affected Versions
IBM InfoSphere Master Data Management	11.0
IBM InfoSphere Master Data Management	11.3
IBM InfoSphere Master Data Management	11.4
IBM InfoSphere Master Data Management	11.5
IBM InfoSphere Master Data Management	11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix
Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------
Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to
a Insecure JSF ViewState found in MDM User Interface (CVE-2016-9714)

Document information

More support for: InfoSphere Master Data Management

Software version: 10.1, 10.1.0, 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006608

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to a Insecure JSF
ViewState found in MDM Busines Admin User Interface which could allow an
attacker to execute malicious and unauthorized actions.

Vulnerability Details

CVEID: CVE-2016-9714
DESCRIPTION: IBM InfoSphere Master Data Management Server is vulnerable to
cross-site request forgery which could allow an attacker to execute malicious
and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119727 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM InfoSphere Master Data Management Server	Affected Versions
IBM InfoSphere Master Data Management			10.1
IBM InfoSphere Master Data Management			11.0
IBM InfoSphere Master Data Management			11.3
IBM InfoSphere Master Data Management			11.4
IBM InfoSphere Master Data Management			11.5
IBM InfoSphere Master Data Management			11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on how to fix.

If you have customized the UI and you already have the source code available
in RAD you can skip step#1 and #2.

1. Locate the com.ibm.mdm.sample.ba.webapp.ear.zip file from MDM sample.
2. Import the projects into RAD and follow Downloading, configuring and
deploying the sample
3. Open web.xml from CommonUIModel
- - enable com.sun.faces.enableHighAvailability in Web.xml

Refer the code below
<context-param>
<description>
If set to true while server-side state saving is being used, a serialized
representation
of the view is stored on the server. This allows for failover and sever
clustering support.
Default is false. This parameter is not available in JSF 1.0.</description>
<param-name>com.sun.faces.enableHighAvailability</param-name>
<param-value>true</param-value>
</context-param>

- - After the code changes do build all

4. Export CustomerBusinessAdmin as EAR
Then From RAD, File -> Export -> Ear File (Under Java EE)
in EAR Export wizard
- - select EAR Project name as 'CustomerBusinessAdmin'
- - Then provide the destination , that earfile name
5. Deploy the this new exported EAR on server
Note: Before installing EAR on server make sure
ClientAuthentication.properties and mdmUIConfiguration.properties of
propertiesUI.jar have valid connection properties.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to
a X-Frame-Options Header ClickJacking attack (CVE-2016-9719 )

Document information

More support for: InfoSphere Master Data Management

Software version: 10.1, 10.1.0, 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006607

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to a X-Frame-Options
Header ClickJacking attack a remote attacker could exploit this vulnerability
to hijack the victim's click actions and possibly launch further attacks
against the victim.

Vulnerability Details

CVEID: CVE-2016-9719
DESCRIPTION: IBM InfoSphere Master Data Management Server could allow a
remote attacker to hijack the clicking action of the victim. By persuading
a victim to visit a malicious Web site, a remote attacker could exploit
this vulnerability to hijack the victim's click actions and possibly launch
further attacks against the victim.
CVSS Base Score: 5.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/119733 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:
Affected IBM InfoSphere Master Data Management Server

Affected Versions
IBM InfoSphere Master Data Management	10.1
IBM InfoSphere Master Data Management	11.0
IBM InfoSphere Master Data Management	11.3
IBM InfoSphere Master Data Management	11.4
IBM InfoSphere Master Data Management	11.5
IBM InfoSphere Master Data Management	11.6

Remediation/Fixes

For Inspector and Web Reports the recommended solution is to apply the fix as
soon as practical. Please see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix
Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

For Busines Admin UI the issue can be resolved by applying the fix
manually. If the UI has been customized and the source code is already
available skip step #1 and #2.

1. Locate the com.ibm.mdm.sample.ba.webapp.ear.zip file from MDM sample.
2. Import the projects into RAD and follow Downloading, configuring and
deploying the sample
3. Open SessionFilter.java from CommonUIModel
- - In doFilter method add the below code provided code at line number 75

//PSIRT 88737 - X-Frame-Options header is not included in the HTTP response
to protect against 'ClickJacking' attacks.
httpResponse.setHeader("X-Frame-Options", "SAMEORIGIN");

- - After the code changes do build all

4. Export CustomerBusinessAdmin as EAR
Then From RAD, File -> Export -> Ear File (Under Java EE)
in EAR Export wizard
- - select EAR Project name as 'CustomerBusinessAdmin'
- - Then provide the destination , that earfile name

5. Deploy the this new exported EAR on server
Note: Before installing EAR on server make sure
ClientAuthentication.properties and mdmUIConfiguration.properties of
propertiesUI.jar have valid connection properties.
Workarounds and Mitigations

None
Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable
to multiple OpenSSL vulnerabilities (CVE-2016-7055, CVE-2017-3730,
CVE-2017-3731, CVE-2017-3732)

Document information

More support for: InfoSphere Master Data Management

Software version: 10.1, 10.1.0, 11.0, 11.0.0, 11.3, 11.4, 11.5, 11.6

Operating system(s): AIX, Linux, Solaris, Windows

Reference #: 2006602

Modified date: 27 July 2017

Security Bulletin

Summary

IBM InfoSphere Master Data Management is vulnerable to multiple OpenSSL
vulnerabilities that could cause the application to crash, an attacker to
obtain information about the private key, or cause a denial of service.

Vulnerability Details

CVEID: CVE-2017-3730
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL
pointer dereference. By sending specially crafted parameters for a DHE or
ECDHE key exchange, a remote attacker could exploit this vulnerability to
cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/121311 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-3731
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by
an out-of-bounds read when using a specific cipher. By sending specially
crafted truncated packets, a remote attacker could exploit this vulnerability
using CHACHA20/POLY1305 to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/121312 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-3732
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a propagation error in the BN_mod_exp() function. An
attacker could exploit this vulnerability to obtain information about the
private key.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/121313 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-7055
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an
error in a Broadwell-specific Montgomery multiplication procedure. By sending
specially crafted data, a remote attacker could exploit this vulnerability
to trigger errors in public-key operations in configurations where multiple
remote clients select an affected EC algorithm and cause a denial of service.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/118748 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM Initiate Master Data Service	Affected Versions
IBM Initiate Master Data Service		10.1
IBM InfoSphere Master Data Management		11.0
IBM InfoSphere Master Data Management		11.3
IBM InfoSphere Master Data Management		11.4
IBM InfoSphere Master Data Management		11.5
IBM InfoSphere Master Data Management		11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product				VRMF	APAR	Remediation/First Fix

Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

IBM InfoSphere Master Data	11.0	None	11.0.0.6-MDM-SAE-FP06IF004
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.3	None	11.3.0.6-MDM-SE-AE-FP06IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.4	None	11.4.0.7-MDM-SE-AE-FP07IF002
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.5	None	11.5.0.5-MDM-SAE-FP05IF001
Management Standard/Advanced
Edition

IBM InfoSphere Master Data	11.6	None	11.6.0.2-MDM-SAE-IF001
Management Standard/Advanced
Edition

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------------------------------------------------------------

Security Bulletin: Multiple security vunerabilities in Oracle Java SE and
Java SE Embedded affects IBM InfoSphere Master Data Management

Document information

More support for: Initiate Master Data Service

Software version: 10.1.0

Operating system(s): AIX, Linux, Platform Independent, Solaris, Windows

Reference #: 2006603

Modified date: 27 July 2017

Security Bulletin

Summary

IBM Initiate Master Data Service is vulnerable to multiple Oracle Java
SE and Java SE Embedded issues and could allow remote attackers to affect
the confidentiality, integrity, and availability.

Vulnerability Details

CVEID: CVE-2017-3514
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to
the Java SE AWT component could allow an unauthenticated attacker to take
control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124893 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID: CVE-2017-3512
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to
the Java SE AWT component could allow an unauthenticated attacker to take
control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124891 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID: CVE-2017-3511
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related
to the Java SE, Java SE Embedded, JRockit JCE component could allow an
unauthenticated attacker to take control of the system.
CVSS Base Score: 7.7
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124890 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID: CVE-2017-3526
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to
the Java SE, Java SE Embedded, JRockit JAXP component could allow an
unauthenticated attacker to cause a denial of service resulting in a high
availability impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124904 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-3509
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the
Java SE, Java SE Embedded Networking component could allow an unauthenticated
attacker to cause low confidentiality impact, low integrity impact, and
no availability impact.
CVSS Base Score: 4.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124888 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID: CVE-2017-3544
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to
the Java SE, Java SE Embedded, JRockit Networking component could allow an
unauthenticated attacker to cause no confidentiality impact, low integrity
impact, and no availability impact.
CVSS Base Score: 3.7
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124920 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2017-3533
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to
the Java SE, Java SE Embedded, JRockit Networking component could allow an
unauthenticated attacker to cause no confidentiality impact, low integrity
impact, and no availability impact.
CVSS Base Score: 3.7
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124910 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2017-3539
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the
Java SE, Java SE Embedded Security component could allow an unauthenticated
attacker to cause no confidentiality impact, low integrity impact, and no
availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/124915 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2017-1289
DESCRIPTION: IBM SDK, Java Technology Edition is vulnerable XML External
Entity Injection (XXE) error when processing XML data. A remote attacker
could exploit this vulnerability to expose highly sensitive information
or consume memory resources.
CVSS Base Score: 8.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/125150 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)

CVEID: CVE-2016-9840
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120508 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9841
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120509 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9842
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
undefined left shift of negative number. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120510 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9843
DESCRIPTION: zlib is vulnerable to a denial of service, caused by a
big-endian out-of-bounds pointer. By persuading a victim to open a specially
crafted document, a remote attacker could exploit this vulnerability to
cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120511 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: Not Applicable
DESCRIPTION: Use this if you deliver IBM Java and are N/A to the IBM
Java SDK update vulnerabilities because the vulnerabilities could not be
exploited by your product. However, customers could run their own Java
code using the IBM Java Runtime delivered with your product.
CVSS Base Score: 0
CVSS Temporal Score: See Not Applicable for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (0)

Affected Products and Versions

These vulnerabilities are known to affect the following offerings:

IBM Initiate Master Data Service version 10.1

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please
see below for information on the fixes available.

Product					VRMF	APAR	Remediation/First Fix
IBM Initiate Master Data Service	10.1	None	10.1.072717_IM_Initiate_MasterDataService_ALL_Interm Fix

Workarounds and Mitigations

None

References
Complete CVSS v3 Guide
On-line Calculator v3

Related information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

27 July 2017: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWXq7x4x+lLeg9Ub1AQhYkQ/+IyCqrFBqkkKD50VyrRX+MzDUiK20pC4k
UAx//klPg126XZd1EOf9Cs1aQlbzPLg59487Dl+/hG6hErnM33/3KxnUBDr0sq5/
tlJsUHKdVxueMf4E5O3g+ptVB4AQT5y4lyN/ScJIJ29gjilrXlTUkN/U+xPNfwZP
LgeqX7fn8Hj+XyVBqsGkNDTEzgb11EQKU2BPjN4kG3R84zQ2LF2WaUp8hoAaexOO
GWG1wI1xrRtGtU6Qhoe62tR13IZlqvbZz9P2BW6dPs8w4TcnHj+PB/IdBJ4WyX2R
76ZSFPKeefq7ZTFKMJ9Qrvyuf77YLgmd1M3AFwlTpzbfa0SqvT+UVz20U63ePmRK
EjO6R8rhCvtKJX5XowfYy7O4Wb+LwtBQje0aXKEM4HulrAAW7jbTv1ISB83GudCU
Fprcxqs6OeaTs/dvfHRBXCO7XzOZA6u0kRC8+l8eTw22qNz355yQeUxa/ajCsyeu
/Rsik/Sa0SFgf93552w/2HYp30XKOtVE236Lsogz/pKYG4P35ruWA++f3RL5NMmM
fIqLikMbYKglcMgtEDqwbDFKkzQqAuuTN+qqfrwMZ7oGkkf9j4saV3O3vR9lIwMP
aGqHb3nmqplYrAU3nqClVUcV1dJMqDAXRIOJSSNV3luB+WNpdiZvBWhdEEvDZxtM
8r3IxILrkn4=
=S9uE
-----END PGP SIGNATURE-----

« Back to bulletins