SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   IBM Spectrum Protect (IBM Tivoli Storage Manager) Vendors:   IBM
(IBM Issues Fix for IBM Spectrum Protect (IBM Tivoli Storage Manager)) Oracle Java SE Bugs Let Remote Usrs Access and Modify Data, Deny Service, and Gain Elevated Privileges
SecurityTracker Alert ID:  1038382
SecurityTracker URL:  http://securitytracker.com/id/1038382
CVE Reference:   CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3260, CVE-2017-3261, CVE-2017-3272, CVE-2017-3289   (Links to External Site)
Date:  May 2 2017
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.1, 8.1
Description:   Multiple vulnerabilities were reported in Oracle Java SE. A remote user can access data on the target system. A remote user can modify data on the target system. A remote user can cause denial of service conditions on the target system. A remote user can gain elevated privileges. IBM Spectrum Protect (IBM Tivoli Storage Manager) is affected.

A remote user can exploit a flaw in the Hotspot component to gain elevated privileges [CVE-2017-3289].

A remote user can exploit a flaw in the Libraries component to gain elevated privileges [CVE-2017-3272].

A remote user can exploit a flaw in the RMI component to gain elevated privileges [CVE-2017-3241].

A remote user can exploit a flaw in the AWT component to gain elevated privileges [CVE-2017-3260].

A remote user can exploit a flaw in the 2D component to cause denial of service conditions [CVE-2017-3253].

A remote user can exploit a flaw in the Libraries component to modify data [CVE-2016-5546].

A remote user can exploit a flaw in the Libraries component to access data [CVE-2016-5548, CVE-2016-5549].

A remote authenticated user can exploit a flaw in the JAAS component to modify data [CVE-2017-3252].

A remote user can exploit a flaw in the Java Mission Control component to partially access data [CVE-2017-3262].

A remote user can exploit a flaw in the Libraries component to cause partial denial of service conditions [CVE-2016-5547].

A remote user can exploit a flaw in the Networking component to partially modify data [CVE-2016-5552].

A remote user can exploit a flaw in the Networking component to partially access data [CVE-2017-3231, CVE-2017-3261].

A remote user can exploit a flaw in the Deployment component to partially access data [CVE-2017-3259].

A remote user can exploit a flaw in the Java Mission Control component to partially modify data [CVE-2016-8328].

The following researchers reported these and other Oracle product vulnerabilities:

Aleksandar Nikolic of Cisco Talos; Alexander Mirosh of Hewlett Packard Enterprise; Alvaro Munoz of Hewlett Packard Enterprise; Andrew Fowler of Lithium; Behzad Najjarpour Jabbari, Secunia Research at Flexera Software; Blessen Thomas of EY Global Delivery Services; Brian Martin of Tenable Network Security;
Daniel Bleichenbacher of Google; Daniel Fahlgren; David Litchfield formerly of Google; Dawid Golunski of Legal Hackers; Deniz Cevik of Biznet Bilisim A.S.; Dmitry Yudin of ERPScan; Emiliano J. Fausto of Onapsis; Gaston Traberg of Onapsis; Jacob Baines - Tenable Network Security (via Trend Micro's Zero Day Initiative); John Page (hyp3rlinx); Kristian Hermansen at undisclosed; Li Qiang of the Qihoo 360 Gear Team;
ma.la of LINE Corporation; Mala; Maris Elsins of Google; Matias Mevied of Onapsis; Moritz Bechler; Nicholas Lemonias of Advanced Information Security Corporation; Owais Mehtab of IS; Per Lindberg; Red Hat Product Security; Roman Shalymov of ERPScan; Shannon Hickey of Adobe; Tayeeb Rana of IS; Ubais PK of EY Global Delivery Services; Wladislaw Mitzel; Wolfgang Hotwagner; Xiejingwei Fei of FINRA;
XOR19 of Trend Micro's Zero Day Initiative; and Zuozhi Fan formerly of Alibaba.

Impact:   A remote user can obtain data on the target system.

A remote user can modify data on the target system.

A remote user can cause denial of service conditions.

A remote user can gain elevated privileges on the target system.

Solution:   IBM has issued a fix for CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3260, CVE-2017-3261, CVE-2017-3272, and CVE-2017-3289 for IBM Spectrum Protect (IBM Tivoli Storage Manager).

The IBM advisory is available at:

http://www-01.ibm.com/support/docview.wss?uid=swg22002479

Vendor URL:  www-01.ibm.com/support/docview.wss?uid=swg22002479 (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Any), UNIX (AIX), Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Jan 19 2017 Oracle Java SE Bugs Let Remote Usrs Access and Modify Data, Deny Service, and Gain Elevated Privileges



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC