Operating System:

[WIN]

Published:

22 March 2019

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2018.3157.2
Security Bulletin: IBM Cognos Controller 2018Q3 Security Updater: Multiple
       vulnerabilities have been identified in IBM Cognos Controller
                               22 March 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Cognos Controller
Publisher:         IBM
Operating System:  Windows
Impact/Access:     Modify Arbitrary Files   -- Remote/Unauthenticated
                   Denial of Service        -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-2800 CVE-2018-2799 CVE-2018-2798
                   CVE-2018-2797 CVE-2018-2796 CVE-2018-2795
                   CVE-2018-2790 CVE-2018-2783 CVE-2018-2678
                   CVE-2018-2677 CVE-2018-2663 CVE-2018-2657
                   CVE-2018-2637 CVE-2018-2634 CVE-2018-2618
                   CVE-2018-2603 CVE-2018-2599 CVE-2018-2588
                   CVE-2018-2579 CVE-2018-0739 CVE-2017-3737
                   CVE-2017-3736 CVE-2017-3735 CVE-2017-12624

Reference:         ASB-2018.0180
                   ASB-2018.0171
                   ASB-2018.0170
                   ASB-2018.0164
                   ESB-2018.2777
                   ESB-2018.2767
                   ESB-2018.2750
                   ESB-2018.2724

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=ibm10717121

Revision History:  March   22 2019: Addition of CVE-2017-12624
                   October 18 2018: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM Cognos Controller 2018Q3 Security Updater: Multiple
vulnerabilities have been identified in IBM Cognos Controller

Download; Update; Security

Document information

More support for: Cognos Controller

Software version: 10.2.0, 10.2.1, 10.3.0, 10.3.1

Operating system(s): Windows

Reference #: 0717121

Modified date: 21 March 2019

Summary

This bulletin addresses several security vulnerabilities that are fixed in IBM
Cognos Business Intelligence Controller.

There are multiple vulnerabilities in IBM(R) Runtime Environment Java(TM)
Technology Edition, Version 7 and the IBM(R) Runtime Environment Java(TM)
Technology Edition, Version 8 that are used by IBM Cognos Controller 10.2.0,
10.2.1, 10.3.0 and 10.3.1. These issues were disclosed as part of the IBM Java
SDK updates in January and April 2018.

Multiple Open Source OpenSSL vulnerabilities affect IBM Cognos Controller
versions 10.2.0, 10.2.1 and 10.3.0.

There is a potential denial of service in Apache CXF which affects IBM Cognos
Controller versions 10.2.0, 10.2.1 and 10.3.0.

Vulnerability Details

CVEs applicable for IBM Cognos Controller 10.2.0, 10.2.1 and 10.3.0:

CVEID: CVE-2017-3735
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an error while parsing an IPAdressFamily extension in
an X.509 certificate. An attacker could exploit this vulnerability to trigger
an out-of-bounds read, resulting in an incorrect text display of the
certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
131047 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2017-3736
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a carry propagation flaw in the x86_64 Montgomery
squaring function bn_sqrx8x_internal(). An attacker with online access to an
unpatched system could exploit this vulnerability to obtain information about
the private key.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
134397 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-3737
DESCRIPTION: An unspecified vulnerability in multiple Oracle products could
allow an unauthenticated attacker to cause low confidentiality impact, low
integrity impact, and high availability impact.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
136077 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-0739
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending
specially crafted ASN.1 data with a recursive definition, a remote attacker
could exploit this vulnerability to consume excessive stack memory.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
140847 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-12624
DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a
specially crafted message attachment header, a remote attacker could exploit
this vulnerability to cause the AX-WS and JAX-RS services stop responding.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
135095 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEs applicable for IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0 and 10.3.1:

CVEID: CVE-2018-2579
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown attack
vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137833 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-2588
DESCRIPTION: An unspecified vulnerability related to the Java SE LDAP
component could allow an authenticated attacker to obtain sensitive
information resulting in a low confidentiality impact using unknown attack
vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137841 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-2663
DESCRIPTION: An unspecified vulnerability to the Java SE Libraries component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137917 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2677
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137932 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2678
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137933 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2599
DESCRIPTION: An unspecified vulnerability related to the Java SE JNDI
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and low availability impact.
CVSS Base Score: 4.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

CVEID: CVE-2018-2603
DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137855 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2657
DESCRIPTION: An unspecified vulnerability related to the Java SE Serialization
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137910 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2618
DESCRIPTION: An unspecified vulnerability related to the Java SE JCE component
could allow an unauthenticated attacker to obtain sensitive information
resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137870 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-2634
DESCRIPTION: An unspecified vulnerability related to the Java SE JGSS
component could allow an unauthenticated attacker to obtain sensitive
information resulting in a high confidentiality impact using unknown attack
vectors.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137886 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID: CVE-2018-2637
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause high confidentiality impact,
high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
137889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2018-2800
DESCRIPTION: An unspecified vulnerability related to the Java SE RMI component
could allow an unauthenticated attacker to cause low confidentiality impact,
low integrity impact, and no availability impact.
CVSS Base Score: 4.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141956 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID: CVE-2018-2795
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141951 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2796
DESCRIPTION: An unspecified vulnerability related to the Java SE Concurrency
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141952 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2797
DESCRIPTION: An unspecified vulnerability related to the Java SE JMX component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141953 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2798
DESCRIPTION: An unspecified vulnerability related to the Java SE AWT component
could allow an unauthenticated attacker to cause a denial of service resulting
in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141954 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2799
DESCRIPTION: An unspecified vulnerability related to the Java SE JAXP
component could allow an unauthenticated attacker to cause a denial of service
resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141955 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-2783
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause high
confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2018-2790
DESCRIPTION: An unspecified vulnerability related to the Java SE Security
component could allow an unauthenticated attacker to cause no confidentiality
impact, low integrity impact, and no availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
141946 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Cognos Controller 10.3.1
IBM Cognos Controller 10.3.0
IBM Cognos Controller 10.2.1
IBM Cognos Controller 10.2.0

Remediation/Fixes

The recommended solution is to apply the fix for versions listed as soon as
practical:

IBM Cognos Controller 10.3.1: http://www.ibm.com/support/docview.wss?uid=ibm10718767
IBM Cognos Controller 10.3.0: http://www.ibm.com/support/docview.wss?uid=ibm10718767
IBM Cognos Controller 10.2.1: http://www.ibm.com/support/docview.wss?uid=ibm10718767
IBM Cognos Controller 10.2.0: http://www.ibm.com/support/docview.wss?uid=ibm10718767

Workarounds and Mitigations

None

Change History

27 July 2018: Original Version Published
21 March 2019: Version updated to include CVE-2017-12624

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXJR2P2aOgq3Tt24GAQg32hAAkPmH7a6BaujahzOYzdSDa3+ZiyxAlJwH
31PGP7QLLOp4iuoLbT0jPlnbBtOQ2DOlqVaOOIo23xKhVkc5VOOeTadoVudZPTuB
ejPci6/5JTQcBP/u+U3HU0gzXX7+2d69I2aC6njtC2D6AsKKoCejUPRqHpcCblb7
vQBdd28TTA17l359h/TQaH05bLT4/giY5RsSMYpEa9DfKwUD9BPu/8e0ztZ8n3hs
tkUZ6c4OYukO+P9ljXhKRD56NHdD1sCsjzCYp7rdEHfAqByVARYDfV7dzFudfKav
SO9tf8k5DyDfipdEsn6tB3y1dvbCtMUTXXpZXEFSp7CP8xQpVW4Y9ruFBwp/+6Fo
S5tFhSVIKi1Zdm2lrrVj4OsCk1Stx72949h33qoTcOnSJe0XqQe5CUl43JZWFAZy
OU2tRJOcewOFB6k5svvIPlYJQB/eqNLbrTZp6QWKMIAk3rS5Xy4ab1PtdQFjfOvd
xfTi1c4xHNmFRD7pQX9JMSmou9Q+hwvaFHWWnK37dyUT/TNrEs6ea7dytkWM1Wnc
WMP1eIIQCAR+U67mR/0jDYvLmrrduVJiJ92thMM72b5jJogoS1CNKUTpzZ+Ibnze
+w87sFSGbLb5inBnltYAb/aalOYh9WAf94/WOh+/CxiLN/mOAt3zo7g0XMHtuv3h
GivHy4YDF6A=
=ulsL
-----END PGP SIGNATURE-----