ESB-2018.3753 - [Win][Linux][HP-UX][Solaris][AIX] IBM WebSphere Remote Server: Multiple vulnerabilities 2018-12-04

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3753
             Security updates for IBM WebSphere Remote Server
                              4 December 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM WebSphere Remote Server
Publisher:         IBM
Operating System:  AIX
                   HP-UX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                   Modify Arbitrary Files          -- Remote with User Interaction
                   Denial of Service               -- Remote/Unauthenticated      
                   Cross-site Scripting            -- Remote with User Interaction
                   Access Confidential Data        -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-18224 CVE-2018-18223 CVE-2018-3302
                   CVE-2018-3234 CVE-2018-3233 CVE-2018-3232
                   CVE-2018-3231 CVE-2018-3230 CVE-2018-3229
                   CVE-2018-3228 CVE-2018-3227 CVE-2018-3226
                   CVE-2018-3225 CVE-2018-3224 CVE-2018-3223
                   CVE-2018-3222 CVE-2018-3221 CVE-2018-3220
                   CVE-2018-3219 CVE-2018-3218 CVE-2018-3217
                   CVE-2018-3147 CVE-2018-1905 CVE-2018-1798
                   CVE-2018-1797 CVE-2018-1643 

Reference:         ASB-2018.0250
                   ESB-2018.3526

Original Bulletin: 
   https://www.ibm.com/support/docview.wss?uid=ibm10741133
   https://www.ibm.com/support/docview.wss?uid=ibm10743713

Comment: This bulletin contains two (2) IBM security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: WebSphere Portal gets Oracle Outside In update

Document information
Software version: 7.0, 8.0, 8.5, 9.0
Operating system(s): Platform Independent
Reference #: 0741133
Modified date: 03 December 2018

Summary

Oracle Outside In Technology is used by and contained in IBM WebSphere Portal.
A fix is available for security vulnerabilities in Oracle Outside In Technology
that affect IBM WebSphere Portal (CVE-2018-3147, CVE-2018-3224, CVE-2018-3302,
CVE-2018-3217, CVE-2018-3218, CVE-2018-3219, CVE-2018-3220, CVE-2018-3221,
CVE-2018-3222, CVE-2018-3223, CVE-2018-3225, CVE-2018-3226, CVE-2018-3227,
CVE-2018-3228, CVE-2018-3229, CVE-2018-3230, CVE-2018-3231, CVE-2018-3232,
CVE-2018-3233, CVE-2018-3234, CVE-2018-18223, CVE-2018-18224).

Vulnerability Details

CVEID: CVE-2018-18224
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters (ODA Module) component could
allow an unauthenticated attacker to cause low confidentiality impact, no
integrity impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151427 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3227
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151542 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3226
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151541 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3218
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause high confidentiality impact, low integrity
impact, and no availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151533 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

CVEID: CVE-2018-3229
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151544 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3217
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause high confidentiality impact, low integrity
impact, and no availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151532 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

CVEID: CVE-2018-3228
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151543 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3219
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause high confidentiality impact, no integrity
impact, and low availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151534 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L)

CVEID: CVE-2018-3230
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151545 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3232
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151547 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3221
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151536 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3231
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151546 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3220
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause high confidentiality impact, no integrity
impact, and low availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151535 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L)

CVEID: CVE-2018-3223
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151538 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3234
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151549 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3233
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151548 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3222
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151537 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3225
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151540 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3302
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151614 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3224
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to cause low confidentiality impact, no integrity
impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151539 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

CVEID: CVE-2018-3147
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters component could allow an
unauthenticated attacker to obtain sensitive information resulting in a low
confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151463 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-18223
DESCRIPTION: An unspecified vulnerability in Oracle Fusion Middleware related
to the Outside In Technology Outside In Filters (ODA Module) component could
allow an unauthenticated attacker to cause low confidentiality impact, no
integrity impact, and high availability impact.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
151426 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

Affected Products and Versions

+-------------------------------------------+
|  Affected Product  |  Affected Versions   |
|--------------------+----------------------|
|IBM WebSphere Portal|9.0.0.0 - 9.0.0.0 CF16|
|--------------------+----------------------|
|IBM WebSphere Portal|8.5.0.0 - 8.5.0.0 CF16|
|--------------------+----------------------|
|IBM WebSphere Portal|8.0.0.0 - 8.0.0.1 CF23|
|--------------------+----------------------|
|IBM WebSphere Portal|7.0.0.0 - 7.0.0.2 CF30|
+-------------------------------------------+

For unsupported versions IBM recommends upgrading to a fixed, supported version
of the product.

Remediation/Fixes

+-----------------------------------------------------------------------------+
| Product  |   VRMF    | APARs |                     Fix                      |
|----------+-----------+-------+----------------------------------------------|
|IBM       |           |       |Upgrade to Cumulative Fix 16 (CF16) and then  |
|WebSphere |9.0        |PH04172|apply the Interim Fix PH04172.                |
|Portal    |           |       |                                              |
|----------+-----------+-------+----------------------------------------------|
|IBM       |           |       |Upgrade to Cumulative Fix 16 (CF16) and then  |
|WebSphere |8.5        |PH04172|apply the Interim Fix PH04172.                |
|Portal    |           |       |                                              |
|----------+-----------+-------+----------------------------------------------|
|IBM       |8.0.0.0    |       |Upgrade to Fix Pack 8.0.0.1 with Cumulative   |
|WebSphere |through    |PH04172|Fix 23 (CF23) and then apply the Interim Fix  |
|Portal    |8.0.01     |       |PH04172.                                      |
|----------+-----------+-------+----------------------------------------------|
|IBM       |7.0.0.0    |       |Upgrade to Fix Pack 7.0.0.2 with Cumulative   |
|WebSphere |through    |PH04172|Fix 30 (CF30) and then apply the Interim Fix  |
|Portal    |7.0.0.2    |       |PH04172.                                      |
+-----------------------------------------------------------------------------+

Workarounds and Mitigations

As a workaround until the fix has been applied, you can disable the conversion
of documents by removing the convertor entries in the file convertors.xml. 

Please follow the steps below to implement the workaround:
1. Stop the IBM WebSphere Portal Server. 
2. Find convertors.xml in <portal_server_root>/wp_profile/PortalServer/dcs
3. Backup this file to restore it after the fix has been applied. 
4. Remove all <input> and <output> entries inside all <convertor> tags in the
convertors.xml file as shown in the following example. 

Find all sections like this: 
<convertor>
<input>application/vnd.openxmlformats-officedocument.wordprocessingml.document
</input>
<input>application/msword</input>
<input>application/vnd.lotus-wordpro</input>
<input>application/html</input>
<input>application/rtf</input>
...
<output>application/vnd.ibm-odcrte.zip</output>
...
<property name="class" value="com.ibm.wps.odc.convert.text.Stellent2RTE"/>
</convertor>

and change them like this: 
<convertor>
<property name="class" value="com.ibm.wps.odc.convert.text.Stellent2RTE"/>
</convertor> 

5. Restart the IBM WebSphere Portal Server.

Change History

3 December 2018: Original version published

- --------------------------------------------------------------------------------

Security Bulletin: Security vulnerabilities have been identified in WebSphere
Application Server shipped with WebSphere Remote Server (CVE-2018-1905),
(CVE-2018-1798), (CVE-2018-1797), (CVE-2018-1643)

Document information
Software version: All Versions
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Software edition: All editions
Reference #: 0743713
Modified date: 03 December 2018

Summary

WebSphere Application Server is shipped with WebSphere Remote Server.
Information about security vulnerabilities affecting WebSphere Application
Server has been published in security bulletins.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

These vulnerabilities affect the following versions and releases of IBM
WebSphere Remote Server:
9.0, 8.5, 7.0

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and
information about fixes addressed by WebSphere Application Server which is
shipped with WebSphere Remote Server.

Principal      Affected Supporting Affected Supporting Product Security
Product and    Product and Version Bulletin
Version(s)

WebSphere      WebSphere           Potential XML External Entity (XXE)
Remote Server  Application Server  Injection Vulnerability in WebSphere
                                   Application Server (CVE-2018-1905)
 9.0
               9.0

WebSphere      WebSphere           Potential cross-site scripting vulnerability
Remote Server  Application Server  in WebSphere Application Server using
9.0, 8.5, 7.0    9.0, 8.5, 8.0,    SIBMsgMigration Utility (CVE-2018-1798)
               7.0
                                    

WebSphere      WebSphere           Potential directory traversal vulnerability
Remote Server  Application Server  in WebSphere Application Server
9.0, 8.5, 7.0    9.0, 8.5, 8.0,    (CVE-2018-1797)
               7.0
                                    

WebSphere      WebSphere           Cross-site scripting vulnerability in
Remote Server  Application Server  Installation Verification Tool of WebSphere
9.0, 8.5         9.0, 8.5, 8.0     Application Server (CVE-2018-1643)

                                    
Change History

4 December 2018: Original Version Published

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXAYBW2aOgq3Tt24GAQgPGg//XOQmzTDE00RJ7dQMncaWRAD3ulHuLosZ
nSUjda2IAKQPJYPvj9aUu7J/ZqvPek24o4LM9ALTk8qLJeFrqoAwd2qu+uFSoSjz
yNYLf8gEOxuvCb9c7hQMRiF8NYFVs0KCvuTzxLOcsHpis8GzA4gX/GwX95fWY9RN
IzFKztuKflp78zb1rZp5L667rjUOUG6DIKLKuzuXXcH2UdlVwXbe0tKx8I1kVASd
n2UNGmlz6BjTQe49MwMRKC15dfJYAuWoismci5zAFq5Bgfkza9C3lYO6GHGNPRi3
ZKJjJQHXzMHieiPsOr27kPy4FFl8q1GAoDGS1Ji5s0/oiLeDYg0nSMcj+EJ6L4ko
tJSrbf4WXUIv7ez8KYDl/1DMOjTxAqdmRrSerwF2Wd1KFfURRw+kmd99hX8RX2Kx
QGMLiOjyalH3+yjSbjEiozKU0NIWKRpmo9Y/2gAeHzHUvIKDUTu5eZ1czNIxVDwR
ykLbaclozk6N8x2hNE9nv3u5Jdta4ueIH0B8QSDoMlP7jjym/iciFIYFGmbY8NYt
xCOHXVO70T5DtWnIP8qumkE2ctte9JDZ6fH1rgF28rpgX0YFyWbpnbtW3Z5GWMmr
IvGPk0wO6yezgXe5uSOUbaWy+zrOuhoa3sjfvErH3v19dGMOGE6Oo0PllBlN18h1
DtQGEv2I6T8=
=SzFF
-----END PGP SIGNATURE-----

« Back to bulletins