Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.1853
IBM Java Application - Arbitrary File Modification
31 May 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Java
Publisher: IBM
Operating System: Network Appliance
Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-2161
Reference: ASB-2021.0076
ESB-2021.1826
ESB-2021.1786
Original Bulletin:
https://www.ibm.com/support/pages/node/6454459
- --------------------------BEGIN INCLUDED TEXT--------------------
CVE-2021-2161 may affect IBM® SDK, Java™ Technology Edition
Document Information
Document number : 6454459
Modified date : 28 May 2021
Product : IBM Java
Software version : All versions
Operating system(s): Platform Independent
Summary
CVE-2021-2161 was disclosed in the Oracle April 2021 Critical Patch Update.
Vulnerability Details
CVEID: CVE-2021-2161
DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries
component could allow an unauthenticated attacker to cause no confidentiality
impact, high integrity impact, and no availability impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
200290 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected Products and Versions
7.0.0.0 - 7.0.10.80
7.1.0.0 - 7.1.4.80
8.0.0.0 - 8.0.6.25
11.0.0.0 - 11.0.10.0
Note: CVE-2021-2161 is applicable only on Windows.
Remediation/Fixes
7.0.10.85
7.1.4.85
8.0.6.30
11.0.11.0
Please refer to the IBM SDK, Java Technology Edition Security Vulnerabilities
page for more information.
IBM customers requiring an update for an SDK shipped with an IBM product should
contact IBM support , and/or refer to the appropriate product security
bulletin.
APAR number:
IJ32230 (CVE-2021-2161)
Workarounds and Mitigations
None
Oracle April 2021 Java SE Critical Patch Update Advisory
IBM SDK, Java Technology Edition Security Vulnerabilities
Acknowledgement
Change History
19 May 2021: Initial Publication
21 May 2021: Added note about platform applicability
28 May 2021: Added 11.0.11.0 to fixed releases
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYLRXseNLKJtyKPYoAQha/A//bAPggCKVCJZsGZ1obxJRJSbGX4Ap1vzZ
CXK4GkMoMtmD+3wQX6AtTqc3SdYXLTGcE6FZ3c6Z+H84Wp6ugKdSV0woyi77Wt+k
QHnnOKopZ20QX47Lyyot7BtwDW/U7eJ4jDaVckazJ5MUmqr6lVfBM87js44e/l/q
f8JekZYl4wuSdkr2ev9Exe0P2/E6JJnGmPwpYl/51xrDjcXUbaYn+O2rmmR3/zir
ud1ayTucb3jqffTYZM56Ph3OF7qNuD80PHzGNQmJ49oUdYCkxuhGeuKQinkTlFVf
7xTfko7C5pWQTTBI/hkVslZbTAEwV1PUKqshSJ+RNC1GCtkpfSYZn4oYvcfObssO
lJaQVBum2WE8+OYW8VkunbD7GPzO2E2d6OM13rnsnjeOpY4bZgTYWFD+EWq59OaU
qluf/Nev+zmUU/AtAXfXZpzcCBZtn+8zOHdKTtM+uPb3oFMsxqLtBITdzLiE77F4
lW4ppcc7GY6s6DlxZEcp8x7isNUGM0xqKQTngwPLxYyArxKkMoH83qQ21Ws8nGw8
7v+6BrFqRGfvtLe09PdfdHjSuxoRk72NglXz6XAJYZPrHLB4pUnIw6HY0TQUaKM4
DlK/q2uY0oZobVVh31xb8EVSqzGNDSi0CKokyHoVsyV6vmciiezAKJMIklNKmbfC
jTrdxxZYTrQ=
=CExg
-----END PGP SIGNATURE-----