copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0540 - [Win][Linux][Solaris][AIX] IBM Rational License Key Server: Multiple vulnerabilities

Date: 01 March 2016
References: ASB-2014.0077  ASB-2014.0121  ESB-2015.1822  ASB-2015.0070  ESB-2016.0124  ESB-2016.0758  ESB-2016.2466  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0540
   Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat
             affect IBM RLKS Administration and Reporting Tool
                               1 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Rational License Key Server
Publisher:         IBM
Operating System:  AIX
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Denial of Service               -- Remote/Unauthenticated      
                   Cross-site Scripting            -- Remote with User Interaction
                   Provide Misleading Information  -- Remote/Unauthenticated      
                   Access Confidential Data        -- Remote/Unauthenticated      
                   Reduced Security                -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2014-7810 CVE-2014-0230 CVE-2014-0227
                   CVE-2014-0119 CVE-2014-0099 CVE-2014-0096
                   CVE-2014-0095 CVE-2014-0075 CVE-2013-4444

Reference:         ESB-2016.0124
                   ASB-2015.0070
                   ESB-2015.1822
                   ASB-2014.0121
                   ASB-2014.0077

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=swg21976103

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat affect 
IBM RLKS Administration and Reporting Tool

Document information

More support for:

Rational License Key Server

RLKS Administration and Reporting Tool

Software version:

8.1.4, 8.1.4.1, 8.1.4.2, 8.1.4.3, 8.1.4.4, 8.1.4.5, 8.1.4.6, 8.1.4.7, 8.1.4.8,
8.1.4.9

Operating system(s):

AIX, Linux, Solaris, Windows

Reference #:

1976103

Modified date:

2016-02-29

Security Bulletin

Summary

Apache Tomcat is shipped as a component of RLKS Administration and Reporting 
Tool (RLKS ART) . Information about multiple security vulnerabilities 
affecting Apache Tomcat, version 7.0.5.2, have been published in this security
bulletin.

Vulnerability Details

CVE ID: CVE-2014-7810

Description: Apache Tomcat could allow a remote attacker to bypass security 
restrictions, caused by the use of expression language. An attacker could 
exploit this vulnerability to bypass the protections of a Security Manager.

CVSS Base Score:5.0

CVSS Temporal Score: See 
https://exchange.xforce.ibmcloud.com/vulnerabilities/103155 for the current 
score

CVSS Environmental Score:*Undefined

CVSS Vector:AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEID: CVE-2013-4444

Description: Apache Tomcat could allow a remote attacker to upload arbitrary 
files, caused by the improper validation of file extensions by the File Upload
feature. By sending a specially crafted HTTP request, a remote attacker could
exploit this vulnerability to upload a malicious JSP, which could allow the 
attacker to execute arbitrary JSP code on the vulnerable system.

CVSS Base Score: 6.0

CVSS Temporal Score: http://xforce.iss.net/xforce/xfdb/95876 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P)

CVEID: CVE-2014-0075

Description: Apache Tomcat is vulnerable to a denial of service, caused by the
improper handling of a malformed chunk size as part of a chunked request. A 
remote attacker could exploit this vulnerability to cause a denial of service.

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93365 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-0095

Description: Apache Tomcat is vulnerable to a denial of service, caused by the
improper handling of an AJP request. A remote attacker could exploit this 
vulnerability to consume a request processing thread and cause a denial of 
service.

CVSS Base Score: 4.3

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93366 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-0096

Description: Apache Tomcat could allow a remote attacker to obtain sensitive 
information, caused by an XML External Entity Injection (XXE) error when 
processing XML data by the default server. By sending specially crafted XML 
data, an attacker could exploit this vulnerability to obtain sensitive 
information.

CVSS Base Score: 4.3

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93367 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID: CVE-2014-0099

Description: Apache Tomcat could allow a remote attacker to obtain sensitive 
information, caused by the failure to check for overflows when parsing content
length headers. By sending specially crafted request, an attacker could 
exploit this vulnerability to obtain sensitive information.

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93369 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2014-0119

Description: Apache Tomcat could allow a remote attacker to obtain sensitive 
information, caused by the replacement of the XML parsers used to process 
XSLTs for the default servlet. An attacker could exploit this vulnerability 
using a specially crafted application to obtain sensitive information.

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93368 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2014-0227

Description: Apache Tomcat is vulnerable to HTTP request smuggling. A remote 
attacker could send a specially crafted request in a malformed chunked header
to the Web server to cause multiple processing conflicts on the servers. An 
attacker could exploit this vulnerability to poison the web cache, bypass web
application firewall protection, and conduct XSS attacks.

CVSS Base Score: 4.3

CVSS Temporal Score: http://xforce.iss.net/xforce/xfdb/100751 for more 
information

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2014-0230

Description: Apache Tomcat is vulnerable to a denial of service, caused by an
error when uploading files. An attacker could exploit this vulnerability to 
consume all available memory resources.

CVSS Base Score: 5.0

CVSS Temporal Score: 
https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102131 for current 
score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

These vulnerabilities affect all versions of IBM RLKS Administration and 
Reporting Tool.

Remediation/Fixes

Remediation

Follow the instructions in How to manually update Apache Tomcat? to upgrade to
Apache Tomcat, version 7.0.6.7, where these vulnerabilities have been fixed.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support 
alerts like this.

References

Complete CVSS v2 Guide

On-line Calculator v2

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the 
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the 
Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVtUpx36ZAP0PgtI9AQIqehAA0OIwyQPAndtKXAvjX3AD4otmkqX1amYy
Q0loWG8fY6ziPuRi4RWcRu4QqVmpXOzVeV+pl0NX7NNpqXQf59Y3DM+7BHxN8byx
2Z2nplKjjgNzfwysIAzv/eB36jKyNWjCx+M3Ds5Q51Ia2THMqlUTSpW/uiHwLzS0
xc66+vPUR5c4pKLLN32cbm6/Nq4rcHG5Pd2FJSzg/MXwpUBUYwJV8ZRg2Exff00u
6wVf6WcIJ5zdyVPv2aC9iq+2O39rWLCD3OpilAskM8zkRQJzaV816wjJZLp8Bbje
y0dh8I+mjvNr3TuZfXDHDVNhNsJvShCFuuDarD5rcEC1Ni/bSG4yisBbxOBixDmy
E7gkDTtcHoP6J6ittN/XKknkMTNZDvN5CLc4xpMmylO9NjJtEK9e1nOtK9JdmHAC
9ctFE9bg1d+UW9f8lOuAYMXIbZdf8/mSR2hJN347JxMu0qlOZchj2UvGQfuANghg
hzhtjKaHODQJS5ZzcSZMtNqHaHCrbaG0SmMSPVKXlSeFVZKg+b9PJASLCUlMma4p
4FGyrmxqryajPb2SEj/vBBKRIyd+Grsiqmi+gsnqLlRtGUCzQZ/QewhRQfiG7C2C
Nan5W9JxXSR7k5b1EFCk5Af7F4EFL0tSyc/7KhH8hS2uyxli/P/9le+I0ASvg0j/
2Hdm1mlEzn8=
=oZ6H
-----END PGP SIGNATURE-----