PT-2018-4104 · Ibm+2 · Ibm Mobile Foundation+3

Published 2018-04-27 · Updated 2018-06-04 · CVE-2013-5391

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Worklight Consumer and Enterprise Editions versions 5.0.x through 5.0.5 and versions 6.0.x through 6.0.0 before Fix Pack 2 IBM Mobile Foundation Consumer and Enterprise Editions versions 5.0.x through 5.0.5 and version 6.0.0 before Fix Pack 2

Description The issue makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging improper initialization of the pseudo random number generator (PRNG) in Android and use of the Java Cryptography Architecture (JCA) by a Worklight program.

Recommendations For IBM Worklight Consumer and Enterprise Editions versions 5.0.x through 5.0.5, update to version 5.0.6 Fix Pack 2 or later. For IBM Worklight Consumer and Enterprise Editions versions 6.0.x through 6.0.0 before Fix Pack 2, update to version 6.0.0 Fix Pack 2 or later. For IBM Mobile Foundation Consumer and Enterprise Editions versions 5.0.x through 5.0.5, update to version 5.0.6 Fix Pack 2 or later. For IBM Mobile Foundation Consumer and Enterprise Editions version 6.0.0 before Fix Pack 2, update to version 6.0.0 Fix Pack 2 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-5391

Affected Products

Android

Ibm Mobile Foundation

Ibm Worklight

Java Cryptography Architecture

References · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/87128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5391 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21665731 · Vendor Advisory