Vulnerability CVE-2016-8919 - CERT Civis.Net

Vulnerability Name:

CVE-2016-8919 (CCN-118529)

Assigned:

2016-10-25

Published:

2017-01-17

Updated:

2017-02-13

Summary:

IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2016-8919

Source: CCN
Type: IBM Security Bulletin T1025035 (Flex System Manager Node)
IBM Flex System Manager (FSM) is affected by a IBM Websphere Application Server (WAS) vulnerability (CVE-2016-8919)

Source: CCN
Type: IBM Security Bulletin T1025082 (Systems Director)
IBM Systems Director (ISD) Storage Control is affected by vulnerabilities in IBM Websphere Application Server (WAS), OpenSSL and IBM Java Runtime.

Source: CCN
Type: IBM Security Bulletin 1993797 (WebSphere Application Server)
Denial of Service with WebSphere Application Server (CVE-2016-8919)

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21993797

Source: CCN
Type: IBM Security Bulletin 1999544 (Spectrum Control Standard Edition)
Multiple vulnerabilities in WebSphere Application Server affect IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2016-9736, CVE-2016-8934, CVE-2016-8919)

Source: CCN
Type: IBM Security Bulletin 2004141 (Tivoli Storage Manager for Virtual Environments)
WebSphere denial of service vulnerability affects Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and FlashCopy Manager for VMware (CVE-2016-8919)

Source: CCN
Type: IBM Security Bulletin 2004242 (Tivoli Monitoring V6)
Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server

Source: CCN
Type: IBM Security Bulletin 2004529 (Tivoli Netcool Configuration Manager)
Denial of Service with WebSphere Application Server that affects IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2016-8919)

Source: CCN
Type: IBM Security Bulletin 2005319 (Connections Docs)
IBM Connections Docs is Vulnerable to Denial of Service Issue inIBM WebSphere Application Server (CVE-2016-8919)

Source: BID
Type: Third Party Advisory, VDB Entry
95650

Source: CCN
Type: BID-95650
IBM WebSphere Application Server CVE-2016-8919 Denial of Service Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1037710

Source: XF
Type: UNKNOWN
ibm-websphere-cve20168919-dos(118529)

Source: CCN
Type: IBM Security Bulletin 1998346 (Content Collector)
WebSphere Application Server vulnerability in IBM Content Collector for Email

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*

AND

cpe:/a:ibm:content_collector:3.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_for_virtual_environments:6.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_for_virtual_environments:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.4:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_manager_node_7955:-:*:*:*:*:*:*:*

OR cpe:/a:ibm:systems_director:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0.7:*:*:*:*:*:*:*

Denotes that component is vulnerable