Security Bulletin
Summary
There are several vulnerabilities that may affect IBM HTTP Server that is used by WebSphere Application Server.
Vulnerability Details
CVEID: CVE-2012-0876
DESCRIPTION: Expat is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple specially-crafted HTTP POST requests to an affected application containing conflicting hash key values, a remote attacker could exploit this vulnerability to cause the consumption of CPU resources.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/73868 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2012-1148
DESCRIPTION: Expat is vulnerable to a denial of service, caused by a memory leak in poolGrow when handling XML data. A remote attacker could exploit this vulnerability to cause the application using the vulnerable XML parsing library to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/73867 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2016-4472
DESCRIPTION: Expat XML parser is vulnerable to a denial of service, caused by the removal by compilers with certain optimization settings. By using a specially-crafted XML data, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114683 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2016-0718
DESCRIPTION: Expat is vulnerable to a buffer overflow, caused by improper bounds checking when processing malformed XML data. By using the Expat library, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113408 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
These vulnerabilities affects the following versions and releases of IBM HTTP Server (powered by Apache) component in all editions of WebSphere Application Server and bundling products.
- Version 9.0
- Version 8.5.5
- Version 8.5
- Version 8.0
- Version 7.0
Remediation/Fixes
For affected IBM HTTP Server for WebSphere Application Server:
The recommended solution is to apply the interim fix, Fix Pack or PTF containing APAR PI66849 for each named product as soon as practical. The original PI66849 interim fixes for these issues have been superseded by the PI73984 fix for more recent vulnerabilities. Please refer to the security bulletins below for the updated interim fixes.
For V9.0.0.0 through 9.0.0.1:
· Refer to security bulletin and apply interim fix PI73984
--OR--
· Apply Fix Pack 9.0.0.2 or later.
For V8.5.0.0 through 8.5.5.10:
· Refer to security bulletin and apply interim fix PI73984
--OR--
· Apply Fix Pack 8.5.5.11 or later.
For V8.0.0.0 through 8.0.0.12:
· Refer to security bulletin and apply interim fix PI73984
--OR--
· Apply Fix Pack 8.0.0.13 or later.
For V7.0.0.0 through 7.0.0.41:
· Refer to security bulletin and apply interim fix PI73984
--OR--
· Apply Fix Pack 7.0.0.43 or later.
Get Notified about Future Security Bulletins
References
Change History
16 August 2016: original document published
17 August 2016: added WebSphere Application Server notification
13 September 2016: scoring changed for CVE-2016-0718 and updated fixpack estimated dates
13 April 2017: updated to later security interim fixes
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
07 September 2022
UID
swg21988026