CVE-2014-0878MEDIUM
Description
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
References
http://secunia.com/advisories/59022
http://secunia.com/advisories/59023
http://secunia.com/advisories/59058
http://secunia.com/advisories/61264
http://www.ibm.com/support/docview.wss?uid=swg21675343
http://www.ibm.com/support/docview.wss?uid=swg21675588
http://www.ibm.com/support/docview.wss?uid=swg21677387
http://www.securityfocus.com/bid/67601
http://www-01.ibm.com/support/docview.wss?uid=swg21672043
http://www-01.ibm.com/support/docview.wss?uid=swg21673836
http://www-01.ibm.com/support/docview.wss?uid=swg21674539
http://www-01.ibm.com/support/docview.wss?uid=swg21676672
http://www-01.ibm.com/support/docview.wss?uid=swg21676703
http://www-01.ibm.com/support/docview.wss?uid=swg21676746
http://www-01.ibm.com/support/docview.wss?uid=swg21679610
http://www-01.ibm.com/support/docview.wss?uid=swg21679713
http://www-01.ibm.com/support/docview.wss?uid=swg21680750
http://www-01.ibm.com/support/docview.wss?uid=swg21681256
http://www-01.ibm.com/support/docview.wss?uid=swg21683484
http://www-01.ibm.com/support/docview.wss?uid=swg21686717
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:ibm:java_sdk:6.0.0.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.1.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.2.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.3.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.4.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.5.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.6.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.7.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.8.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.8.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.9.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.9.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.9.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.10.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.10.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.11.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.12.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.13.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.13.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.13.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:6.0.14.0:*:*:*:technology:*:*:*
Configuration 2
OR
cpe:2.3:a:ibm:java_sdk:5.0.0.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.11.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.11.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.11.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.3:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.4:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.12.5:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.13.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.14.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.15.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.16.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.16.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.16.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:5.0.16.3:*:*:*:technology:*:*:*
Configuration 3
OR
cpe:2.3:a:ibm:java_sdk:7.0.0.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.1.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.2.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.3.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.4.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.4.1:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.4.2:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.5.0:*:*:*:technology:*:*:*
cpe:2.3:a:ibm:java_sdk:7.0.6.0:*:*:*:technology:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 9699 | IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | critical |
| 83625 | SUSE SLES10 Security Update : IBM Java 5 (SUSE-SU-2014:0732-1) | Nessus | SuSE Local Security Checks | critical |
| 79039 | RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2014:0982) | Nessus | Red Hat Local Security Checks | critical |
| 76995 | IBM WebSphere Application Server 8.0 < Fix Pack 9 Multiple Vulnerabilities | Nessus | Web Servers | high |
| 76967 | IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities | Nessus | Web Servers | high |
| 76900 | RHEL 7 : java-1.7.1-ibm (RHSA-2014:0705) | Nessus | Red Hat Local Security Checks | critical |
| 76870 | AIX Java Advisory : java_apr2014_advisory.asc | Nessus | AIX Local Security Checks | critical |
| 74284 | SuSE 11.3 Security Update : IBM Java 6 (SAT Patch Number 9256) | Nessus | SuSE Local Security Checks | critical |
| 74254 | SuSE 11.3 Security Update : IBM Java 7 (SAT Patch Number 9263) | Nessus | SuSE Local Security Checks | critical |
| 74032 | RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2014:0509) | Nessus | Red Hat Local Security Checks | critical |
| 74031 | RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2014:0508) | Nessus | Red Hat Local Security Checks | critical |
| 74005 | RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2014:0486) | Nessus | Red Hat Local Security Checks | critical |