Cisco IME experts,
I just installed IME, and noticed that it includes an old 2009-vintage MySQL version that has known security vulnerabilities. It also uses a private JRE version that is fairly old (1.6u7, IIRC). I would like to use IME, but I have to meet fairly stringent security requirements, and these vulnerable versions of bundled products are going to raise red flags. Can I delete the private JRE directory and modify the .ini files to point to the 1.6u23 JRE installed on the system? Can the MySQL version be upgraded to >= v5.1.52, or can you explain why it is not a threat to system security? Granted, the system running IME is within a protected network, but we are trying to implement defense-in-depth principles, and attacks can sometimes come from insiders with a flash drive or CD. Thanks for your answers in advance!
IME 7.1.1 is going to include JRE 1.6u23. We do not support any modification of IME like replacing the JRE as you have suggested.
We have entered a bug to make sure we are updating the database on a schedule, so updates like these can be made periodically. The bug is CSCtn26880.
We think that the current version of MySQL is not a threat to system security for several reasons:
- The server is configured to accept only local connections.
- There is no default admin login.
- The admin password is unique to each installation and is not available to the user.
However, security can be enhanced by installing on a Win 7 box since only admin users will have access to the IME files. This will be available when Windows 7 is supported in IME 7.1(1).
IME 7.1.1 is due out this month--maybe even this week.