How to remediate – AIX Java Advisory : java_apr2017_advisory.asc (April 2017 CPU)

1. Introduction

The vulnerability, AIX Java Advisory : java_apr2017_advisory.asc (April 2017 CPU), affects multiple versions of the Java SDK installed on AIX systems. This is a collection of vulnerabilities within the Java platform that could allow an attacker to execute code remotely or gain elevated privileges. Systems running vulnerable Java installations are at risk of denial of service, data breaches and system compromise.

2. Technical Explanation

The affected Java SDK versions contain multiple vulnerabilities in subcomponents like zlib, XML, Networking, JCE, and AWT. These flaws include unspecified code execution, privilege escalation, and remote attacks leading to denial of service or data access. An unauthenticated attacker could exploit these vulnerabilities by sending crafted requests to a vulnerable system.

• Root cause: Multiple subcomponents contain flaws such as missing input validation, allowing malicious data to be processed.
• Exploit mechanism: Attackers can send specially crafted XML payloads or network requests to trigger the vulnerabilities and execute arbitrary code.
• Scope: AIX systems running affected Java SDK versions are vulnerable. Java SE version 6 is not affected by CVE-2017-3511 and CVE-2017-3512.

3. Detection and Assessment

To confirm vulnerability, check the installed Java SDK version. A thorough assessment involves reviewing system logs for exploitation attempts.

• Quick checks: Use the `java -version` command to display the installed Java version.
• Scanning: Nessus plugin IDs 8d03f97b, ce533d8f, 17d05c61, d4595696, 9abd5252, 4ee03dc1, 8f7a066c and 52d4ddf3 can be used to identify vulnerable systems.
• Logs and evidence: Review system logs for errors related to Java components or unusual network activity.

java -version

4. Solution / Remediation Steps

Apply the fixes available from IBM AIX website by updating to a patched version of the Java SDK.

4.1 Preparation

• Ensure you have access to the IBM AIX website and download the appropriate patch for your system. A roll back plan involves restoring from backup or reverting to the previous Java SDK version.
• A change window may be required depending on service impact. Approval from a system administrator is recommended.

4.2 Implementation

1. Step 1: Download the appropriate patch file from the IBM AIX website.
2. Step 2: Install the patch using the `installp` command. For example, `installp -a .asc`.
3. Step 3: Verify the installation was successful by checking the installed Java version again.

4.3 Config or Code Example

Before

java -version (showing vulnerable version)

After

java -version (showing patched version)

4.4 Security Practices Relevant to This Vulnerability

Practices such as least privilege and a robust patch cadence are relevant to this vulnerability. Least privilege limits the impact of exploitation, while regular patching ensures systems are protected against known flaws.

• Practice 1: Implement least privilege principles to restrict access to Java components.
• Practice 2: Establish a regular patch management cycle for Java SDK and other software.

4.5 Automation (Optional)

Automation is not included as it depends on the specific AIX environment and configuration.

5. Verification / Validation

• Post-fix check: Run `java -version` and confirm it displays the patched version number.
• Re-test: Repeat the initial `java -version` command to verify the updated version is installed.
• Monitoring: Monitor system logs for any errors related to Java components following the update.

java -version (showing patched version)

6. Preventive Measures and Monitoring

Update security baselines to include the latest Java SDK versions. Implement checks in CI/CD pipelines to prevent deployment of vulnerable versions. Maintain a regular patch review cycle for all software components.

• Baselines: Update your AIX system baseline or policy to require patched Java SDK versions.
• Pipelines: Add static analysis (SAST) and software composition analysis (SCA) checks in CI/CD pipelines to identify vulnerable dependencies.
• Asset and patch process: Implement a regular review cycle for patches, aiming for timely application of security updates.

7. Risks, Side Effects, and Roll Back

Applying the patch may cause compatibility issues with existing applications that rely on specific Java features. Ensure thorough testing before deploying to production. To roll back, restore from backup or revert to the previous Java SDK version using `installp -u .asc`.

• Risk or side effect 1: Potential compatibility issues with existing applications. Mitigation involves thorough testing in a non-production environment.
• Risk or side effect 2: Service downtime during patch installation and verification. Mitigation involves scheduling the update during off-peak hours.
• Roll back: 1) Stop affected services. 2) Restore from backup or use `installp -u .asc` to revert to the previous Java SDK version. 3) Restart affected services.

8. References and Resources

• Vendor advisory or bulletin: http://www.nessus.org/u?8d03f97b
• NVD or CVE entry: Multiple CVEs are listed in the description (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2017-1289, CVE-2017-3509, CVE-2017-3511, CVE-2017-3512, CVE-2017-3514, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
• Product or platform documentation relevant to the fix: IBM AIX website for patch downloads.