Vulnerability Details : CVE-2014-0878
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
Products affected by CVE-2014-0878
- cpe:2.3:a:ibm:java_sdk:6.0.3.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.4.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.5.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.9.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.10.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.14.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.15.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.0.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.8.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.8.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.12.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.13.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.1.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.2.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.9.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.9.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.13.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.13.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.6.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.7.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.10.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.11.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:6.0.15.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.0.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.11.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.5:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.13.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.4:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.5:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.11.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.11.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.14.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.15.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.3:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.12.4:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:5.0.16.3:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.4.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.4.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.4.2:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.1.0.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.5.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.6.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.0.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.1.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.6.1:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.2.0:*:*:*:technology:*:*:*
- cpe:2.3:a:ibm:java_sdk:7.0.3.0:*:*:*:technology:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0878
0.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0878
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST |
CWE ids for CVE-2014-0878
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0878
-
http://www-01.ibm.com/support/docview.wss?uid=swg21674539
IBM Security Bulletin: IBM Operational Decision Manager, WebSphere ILOG JRules and WebSphere Business Events: Multiple security vulnerabilities in IBM JRE
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/91084
IBM Secure Random weak security CVE-2014-0878 Vulnerability Report
-
http://www.ibm.com/support/docview.wss?uid=swg21675343
IBM Security Bulletin: Multiple vulnerabilities in IBM Multi-Enterprise Integration Gateway (CVE-2014-0460, CVE-2014-0878, CVE-2014-0453)
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676703
IBM notice: The page you requested cannot be displayed
-
http://www-01.ibm.com/support/docview.wss?uid=swg21679610
IBM Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere eXtreme Scale
-
http://www-01.ibm.com/support/docview.wss?uid=swg21689593
IBM Security Bulletin: AppScan Standard can be affected by vulnerability in the current IBM SDK for Java (CVE-2014-0878, CVE-2014-4244, CVE-2014-4263)Vendor Advisory
-
http://www.ibm.com/support/docview.wss?uid=swg21675588
IBM notice: The page you requested cannot be displayed
-
http://www-01.ibm.com/support/docview.wss?uid=swg21679713
IBM SmartCloud Provisioning 2.1 Fix Pack 5 (SCP - 2.1.0.5)
-
http://www.securityfocus.com/bid/67601
IBM Java SDK CVE-2014-0878 Security Bypass Vulnerability
-
http://secunia.com/advisories/61264
Sign in
-
http://www-01.ibm.com/support/docview.wss?uid=swg21683484
IBM notice: The page you requested cannot be displayed
-
http://www-01.ibm.com/support/docview.wss?uid=swg21681256
IBM Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java™ Technology Edition affect IBM SmartCloud Provisioning (CVE-2014-0878, CVE-2014-0460, CVE-2014-0453).
-
http://www.ibm.com/support/docview.wss?uid=swg21677387
IBM Security Bulletin: Security vulnerabilities in IBM SDK, Java™ Technology Edition (CVE-2014-0878, CVE-2014-0460, CVE-2014-0453, CVE-2014-2420) affect SmartCloud Provisioning
-
http://www-01.ibm.com/support/docview.wss?uid=swg21673836
IBM Security Bulletin: Multiple vulnerabilities in IBM API Management
-
http://www-01.ibm.com/support/docview.wss?uid=swg21680750
IBM Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676746
IBM Security Bulletin: IBM Lotus Expeditor fixes for multiple vulnerabilities in IBM JRE
-
http://www-01.ibm.com/support/docview.wss?uid=swg21686717
IBM Security Bulletin: Rational Insight - IBM SDK, Java Technology Edition Quarterly CPU - April 2014 (CVE-2014-0460, CVE-2014-0878)Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21672043
IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology EditionVendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676672
IBM Security Bulletin: Multiple vulnerabilities in the IBM SDK Java Technology Edition component of IBM MessageSight 1.0-1.1 (CVE-2014-0878, CVE-2014-0460 & CVE-2014-0453)
Jump to