====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN494
____________________________________________________________________

DATE                : 21/12/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : z/OS running IBM HTTP Server for z/OS Version 5.3.

======================================================================
http://www-01.ibm.com/support/docview.wss?uid=swg21620945
______________________________________________________________________

Security vulnerability in IBM HTTP Server for z/OS Version 5.3 (PM79239)


Flash (Alert)


Abstract

IBM HTTP Server for z/OS Version 5.3 could allow a remote attacker to
execute arbitrary commands on the system.


Content


Vulnerability Details:

CVE ID: CVE-2012-5955

CVSS:

CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/80684 for the
current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/AU:N/C:C/I:C/A:C)


Versions Affected :

    IBM HTTP Server for z/OS Version 5.3


Solution:

For IBM HTTP Server for z/OS Version 5.3

    Apply PTF UK90469 or later which includes APAR PM79239
through normal customer ordering channels.

Important note from IBM Support: IBM strongly suggests that all System
z customers be subscribed to the System z Security Portal to receive
the latest critical System z security and integrity service. If you are
not subscribed, see the instructions at the System z Security Portal.
Important security and integrity APARs and associated fixes will be
posted to this portal. IBM suggests that any security or integrity fix
be applied as soon as possible to minimize any potential risk.


Workaround(s): None.


Mitigation(s): None.


REFERENCES:

    Complete CVSS Guide
    On-line Calculator V2
    X-Force Vulnerability Database


RELATED INFORMATION:

    IBM Product Security Incident Response Blog
    IBM Secure Engineering Web Portal


CHANGE HISTORY:

    19 December 2012: Original copy


*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the
impact of this vulnerability in their environments by accessing the
links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams
(FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry
open standard designed to convey vulnerability severity and help to
determine urgency and priority of response." IBM PROVIDES THE CVSS
SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR
POTENTIAL SECURITY VULNERABILITY.


Copyright and trademark information

IBM, the IBM logo and ibm.com are trademarks of International Business
Machines Corp., registered in many jurisdictions worldwide. Other
product and service names might be trademarks of IBM or other
companies. A current list of IBM trademarks is available on the Web at
"Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================