ESB-2018.2167 - [Win] IBM Cognos Planning: Multiple vulnerabilities 2018-07-26

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2167
           Security Bulletin: IBM Cognos Planning is affected by
                         multiple vulnerabilities.
                               26 July 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Cognos Planning
Publisher:         IBM
Operating System:  Windows
Impact/Access:     Access Privileged Data          -- Remote/Unauthenticated      
                   Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Modify Arbitrary Files          -- Remote/Unauthenticated      
                   Denial of Service               -- Remote/Unauthenticated      
                   Provide Misleading Information  -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-2814 CVE-2018-2800 CVE-2018-2799
                   CVE-2018-2798 CVE-2018-2797 CVE-2018-2796
                   CVE-2018-2795 CVE-2018-2790 CVE-2018-2783
                   CVE-2018-2678 CVE-2018-2677 CVE-2018-2663
                   CVE-2018-2657 CVE-2018-2637 CVE-2018-2634
                   CVE-2018-2618 CVE-2018-2603 CVE-2018-2599
                   CVE-2018-2588 CVE-2018-2579 CVE-2018-0739
                   CVE-2017-10388 CVE-2017-10357 CVE-2017-10356
                   CVE-2017-10355 CVE-2017-10350 CVE-2017-10349
                   CVE-2017-10348 CVE-2017-10347 CVE-2017-10345
                   CVE-2017-10295 CVE-2017-10281 CVE-2017-3737
                   CVE-2017-3736 CVE-2017-3735 CVE-2016-10165
                   CVE-2016-9843 CVE-2016-9842 CVE-2016-9841
                   CVE-2016-9840  

Reference:         ASB-2018.0134
                   ASB-2018.0118
                   ESB-2017.0805
                   ESB-2017.0492

Original Bulletin: 
   https://www.ibm.com/support/docview.wss?uid=ibm10718447

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM Cognos Planning is affected by multiple
vulnerabilities.

Document information

More support for: Cognos Planning

Software version: 10.2.0, 10.2.1

Operating system(s): Windows

Reference #: 0718447

Modified date: 25 July 2018

Security Bulletin

Summary

This bulletin addresses several security vulnerabilities that are fixed
in IBM Cognos Planning.

IBM Cognos Planning consumes OpenSSL. Multiple vulnerabilities have been
addressed in OpenSSL.

There are multiple vulnerabilities in IBM(R) Runtime Environment Java(TM)
Technology Edition Version 7 that is used by IBM Cognos Planning. These
issues were disclosed as part of the IBM Java SDK updates in October 2017,
January 2018 and April 2018.

Vulnerability Details

CVEID: CVE-2017-3735
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an error while parsing an IPAdressFamily extension
in an X.509 certificate. An attacker could exploit this vulnerability to
trigger an out-of-bounds read, resulting in an incorrect text display of
the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/131047 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2017-3736
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a carry propagation flaw in the x86_64 Montgomery
squaring function bn_sqrx8x_internal(). An attacker with online access to
an unpatched system could exploit this vulnerability to obtain information
about the private key.
CVSS Base Score: 5.9
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/134397 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-3737
DESCRIPTION: An unspecified vulnerability in multiple Oracle products could
allow an unauthenticated attacker to cause low confidentiality impact,
low integrity impact, and high availability impact.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136077 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-0739
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending
specially crafted ASN.1 data with a recursive definition, a remote attacker
could exploit this vulnerability to consume excessive stack memory.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/140847 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10345
DESCRIPTION: An unspecified vulnerability related to the Java SE
Serialization component could allow an unauthenticated attacker to cause
a denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133774 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10295
DESCRIPTION: An unspecified vulnerability related to the Java SE Networking
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133729 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)

CVEID: CVE-2017-10281
DESCRIPTION: An unspecified vulnerability related to the Java SE
Serialization component could allow an unauthenticated attacker to cause
a denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133720 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10350
DESCRIPTION: An unspecified vulnerability related to the Java SE JAX-WS
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133779 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10347
DESCRIPTION: An unspecified vulnerability related to the Java SE
Serialization component could allow an unauthenticated attacker to cause
a denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133776 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10349
DESCRIPTION: An unspecified vulnerability related to the Java SE JAXP
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133778 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10348
DESCRIPTION: An unspecified vulnerability related to the Java SE Embedded
Libraries component could allow an unauthenticated attacker to cause a
denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133777 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10357
DESCRIPTION: An unspecified vulnerability related to the Java SE
Serialization component could allow an unauthenticated attacker to cause
a denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133786 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10355
DESCRIPTION: An unspecified vulnerability related to the Java SE Networking
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133784 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9841
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120509 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-10356
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a high confidentiality impact using unknown
attack vectors.
CVSS Base Score: 6.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133785 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-10388
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to take control of
the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133813 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-9843
DESCRIPTION: zlib is vulnerable to a denial of service, caused by a
big-endian out-of-bounds pointer. By persuading a victim to open a specially
crafted document, a remote attacker could exploit this vulnerability to
cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120511 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9842
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
undefined left shift of negative number. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120510 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9840
DESCRIPTION: zlib is vulnerable to a denial of service, caused by an
out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to
open a specially crafted document, a remote attacker could exploit this
vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/120508 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-10165
DESCRIPTION: Little CMS is vulnerable to a denial of service, caused by
an out-of-bounds read in Type_MLU_Read function in cmstypes.c. By using a
specially-crafted image, a remote attacker could exploit this vulnerability
to cause the application to crash or obtain sensitive information.
CVSS Base Score: 6.5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/127028 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

CVEID: CVE-2018-2579
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown
attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137833 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-2588
DESCRIPTION: An unspecified vulnerability related to the Java SE LDAP
component could allow an authenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown
attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137841 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-2663
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137917 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2677
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137932 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2678
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137933 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2599
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and low availability impact.
CVSS Base Score: 4.8
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137851 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

CVEID: CVE-2018-2603
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137855 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2657
DESCRIPTION: An unspecified vulnerability related to the Java SE
Serialization component could allow an unauthenticated attacker to cause
a denial of service resulting in a low availability impact using unknown
attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137910 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2618
DESCRIPTION: An unspecified vulnerability related to the Java SE JCE
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a high confidentiality impact using unknown
attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137870 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-2634
DESCRIPTION: An unspecified vulnerability related to the Java SE JGSS
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a high confidentiality impact using unknown
attack vectors.
CVSS Base Score: 6.8
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137886 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID: CVE-2018-2637
DESCRIPTION: An unspecified vulnerability related to the Java SE
JMX component could allow an unauthenticated attacker to cause high
confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137889 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2018-2800
DESCRIPTION: An unspecified vulnerability related to the Java SE
RMI component could allow an unauthenticated attacker to cause low
confidentiality impact, low integrity impact, and no availability impact.
CVSS Base Score: 4.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141956 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID: CVE-2018-2795
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141951 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2796
DESCRIPTION: An unspecified vulnerability related to the Java SE Concurrency
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141952 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2797
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141953 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2798
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141954 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2799
DESCRIPTION: An unspecified vulnerability related to the Java SE JAXP
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141955 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2783
DESCRIPTION: An unspecified vulnerability related to the Java SE
Security component could allow an unauthenticated attacker to cause high
confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141939 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2018-2814
DESCRIPTION: An unspecified vulnerability related to the Java SE VM component
could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141970 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID: CVE-2018-2790
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and no availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/141946 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Cognos Planning 10.2.1
IBM Cognos Planning 10.2.0

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical.  As the
fix is in a shared component across the IBM Cognos Business Intelligence
portfolio, applying the Cognos Business Intelligence 10.2.2 Interim Fix
will resolve the issue.

+--------------------+--------+-------------------------------------------------------+
|                    |Version |Interim Fix                                            |
+--------------------+--------+-------------------------------------------------------+
|IBM Cognos Planning |10.2.1  |IBM Cognos Business Intelligence 10.2.2 Interim Fix 19 |
+--------------------+--------+-------------------------------------------------------+
|IBM Cognos Planning |10.2.0  |IBM Cognos Business Intelligence 10.2.2 Interim Fix 19 |
+--------------------+--------+-------------------------------------------------------+

Workarounds and Mitigations

None

Change History

25 July 2018: Original Version Published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency
and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING
THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW1lI22aOgq3Tt24GAQi6fg//c+psGNU5vD+uOQgCFx0/3d9CRX+YWnhg
s5RxmPZxUdlerKluuQOlOmifSrWufMKMshrJlMNI/EY6KYryX+ASQJqDyxi2GsSS
KVKTFwQqqxBeWASubVSMSjBgSu3C4pSbPo8XPcOl6TAXl7YgcGkj3NlIY4ZdTi1c
B1PpvEOOdksFfXo4oZvNX3PJwehvRc6Qjlz97XI3e2fc7lemBvYswWgAoTijHHqw
i4p4EJ9rfU4L9XzDuIotAoOm9kfZD6+n+zdPHqSnSm5wgwhMrDFfQoImgbL32SHv
r1cEHCGzuf0EhqnotwHqHB87fiu/pExIK+M6kD5s2tlqaxwAhwcA8IMslJSgz67z
9tQf/nfINJTODYAgHrChkHk5mTU6TyOnWJtufPDIuKfnz9Pu8eOAdR3eky5O8QPI
PZxixYIMNvPRJ5kXTYatvvowaNPT/o3JqPXzttmHKmdffSqdjisRcSJ6NAep5oay
Z1Do8wqiq1tGZv50XHak/xciPUMCFj8w3FQ59qxAOIvVI9MA+GeftlhIsJY9cebc
gfgSL/jZMIHfurkI/row6RYhFIMA1nFswzIyi4JW22oCwNkWN+ZQzCBKH4vtIRQ9
29hcw1ILhi0mYtCXqCNhA/dLywvkry7p0w9JdgduI+O977xVyv9L9cmVmnqAe+JJ
nlHl8+rKW/k=
=aYzx
-----END PGP SIGNATURE-----

« Back to bulletins