IBM PI50993:Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577) - United States PI50993; PI50993; PI50993 DOWNLOADABLE FILES

ABSTRACT
 Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577) 

DOWNLOAD DESCRIPTION
PI50993 resolves the following problem:

ERROR DESCRIPTION:
Apache HTTPComponents vulnerabilities in WebSphere Application Server 
LOCAL FIX: 

PROBLEM SUMMARY:
Apache HTTPComponents vulnerabilities in WebSphere Application Server

PROBLEM CONCLUSION:
Apache HTTPComponents vulnerabilities in WebSphere Application Server 

PREREQUISITES
None

INSTALLATION INSTRUCTIONS
Please review the readme.txt for detailed installation instructions.

URL LANGUAGE SIZE(Bytes) Readme [ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PI50993/8.0.0.11/readme.txt] US English 2260 Readme [ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PI50993/8.5.5.7/readme.txt] US English 2296 
DOWNLOAD PACKAGE


KNOWN SIDE EFFECTS
There would be NoClassDefFoundError observed after applying the fix because the API in HTTPCore and HTTPClient libraries are no long visible to application. To resolve this error, application may need to be updated with HTTPCore and HTTPClient libraries bundled.

Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options 
What is Fix Central(FC)? [https://www.ibm.com/support/fixcentral/help?page=swfaqs] 8.5.5.6-WS-WASProd-IFPI50993 12-03-2015 US English 254093 HTTP [http://www-933.ibm.com/eserver/support/fixes/fixcentral/swgquickorder?fixes=8.5.5.6-WS-WASProd-IFPI50993&productid=WebSphere%20Application%20Server&brandid=5] 8.0.0.10-WS-WASProd-IFPI50993 12-03-2015 US English 253242 HTTP [http://www-933.ibm.com/eserver/support/fixes/fixcentral/swgquickorder?fixes=8.0.0.10-WS-WASProd-IFPI50993&productid=WebSphere%20Application%20Server&brandid=5] 
TECHNICAL SUPPORT
 Contact IBM Support using SR (http://www.ibm.com/software/support/probsub.html [http://www.ibm.com/software/support/probsub.html]), visit the WebSphere Application Server support web site (http://www.ibm.com/software/webservers/appserv/was/support/ [http://www.ibm.com/software/webservers/appserv/was/support/]), or contact 1-800-IBM-SERV (U.S. only). 

 [/support/docview.wss?uid=swg24041394&aid=1]Problems (APARS) fixed [/support/docview.wss?uid=swg24041394&aid=2]Problems (APARS) fixed
PI50993
Crash happened due to "PI50993:Apache HTTPComponents vulnerabilities in WebSphere Application Server (CVE-2012-6153, CVE-2014-3577)" 

Details of gpf crash events: A VerifyError was thrown due to "Inaccessible class" at offset 39(0x27) of the method executeInternal(Lorg/springframework/http/HttpHeaders;[B)Lorg/springfram ework/http/client/ClientHttpResponse of the above class org/springframework/http/client/HttpComponentsClientHttpRequest.

Looking at method the bytecodes :

31 invokespecial 15 org/apache/http/entity/ByteArrayEntity.([B)V 34 astore 4 36 aload3 37 aload 4 39 invokeinterface2 41 invokeinterface 16 org/apache/http/HttpEntityEnclosingRequest.setEntity(Lorg/apache/http/Ht tpEntity;)V

The above sequence of bytecodes indicates it created an instance of org/apache/http/entity/ByteArrayEntity, trying to cast it to type Lorg/apache/http/HttpEntity; which in turns led to the "Inaccessible class" VerifyError message.

It is clear that class org/apache/http/HttpEntity was not loaded at all:

    allclasses | grep org/apache/http/HttpEntity

There would be NoClassDefFoundError observed after applying the fix because the API in HTTPCore and HTTPClient libraries are no long visible to application. To resolve this error, application may need to be updated with HTTPCore and HTTPClient libraries bundled.