Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0237
IBM PureApplication System is affected by multiple vulnerabilities
29 January 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM PureApplication System
Publisher: IBM
Operating System: Linux variants
AIX
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1000001 CVE-2018-13785 CVE-2018-6982
CVE-2018-6981 CVE-2018-6974 CVE-2018-6972
CVE-2018-3646 CVE-2018-3639 CVE-2018-3620
CVE-2018-3615 CVE-2018-3214 CVE-2018-3180
CVE-2018-3139 CVE-2018-3136 CVE-2018-2952
CVE-2017-16997
Reference: ESB-2019.0032
ESB-2018.3918
ESB-2019.0153.2
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10731129
http://www.ibm.com/support/docview.wss?uid=ibm10728587
http://www.ibm.com/support/docview.wss?uid=ibm10795276
http://www.ibm.com/support/docview.wss?uid=ibm10795272
http://www.ibm.com/support/docview.wss?uid=ibm10794637
http://www.ibm.com/support/docview.wss?uid=ibm10795181
http://www.ibm.com/support/docview.wss?uid=ibm10795270
Comment: This bulletin contains seven (7) IBM security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: IBM PureApplication System is affected by a vulnerability
(CVE-2018-3639) pertaining third-party CPU hardware
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux
Software edition:
All Editions
Reference #:
0731129
Modified date:
25 January 2019
Summary
IBM has released Version 2.2.5.3 for IBM PureApplication System, which
includes IBM OS image for AIX Systems and IBM OS images for Red Hat Linux
Systems based deployments, to address a vulnerability in response to
CVE-2018-3639. IBM PureApplication System has addressed the following
vulnerability.
Vulnerability Details
CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU's could allow a local
attacker to obtain sensitive information, caused by utilizing sequences of
speculative execution and speculative execution of memory reads before the
addresses of all prior memory writes are known. By conducting targeted cache
side-channel attacks, an attacker could exploit this vulnerability to bypass
security restrictions and gain read access to privileged memory. Note: This
vulnerability is the Speculative Store Bypass (SSB), also known as Variant 4
or "SpectreNG".
CVSS Base Score: 4.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/143569 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
The PureSystems(R) Manager on IBM PureApplication System is affected.
AIX:
Follow the steps from this bulletin to apply the AIX fix updates:
http://www-01.ibm.com/support/docview.wss?uid=isg3T1027700
OR
Upgrade IBM PureApplication System to the following fix pack release:
IBM PureApplication V2.2.5.3
Linux:
For Red Hat Enterprise Linux fix updates, upgrade IBM PureApplication System
to the following fix pack release: IBM PureApplication V2.2.5.3
Contact IBM for assistance. Information on upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: IBM PureApplication System is affected by a vulnerability
in VMWare component (CVE-2018-6972)
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux, Windows
Software edition:
All Editions
Reference #:
0728587
Modified date:
25 January 2019
Summary
There is a vulnerability in the VMWare component that is used by IBM
PureApplication System. The following vulnerability has been addressed.
Vulnerability Details
CVEID: CVE-2018-6972 DESCRIPTION: VMware ESXi, Workstation, and Fusion are
vulnerable to a denial of service, caused by a NULL pointer dereference in
RPC handler. By sending a specially-crafted request, a local attacker could
exploit this vulnerability to cause the virtual machine to crash.
CVSS Base
Score: 6.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/147146 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
The solution is to upgrade the IBM PureApplication System to the following
fix pack release: IBM PureApplication V2.2.5.3 IBM recommends upgrading to a
fixed version of the product. Contact IBM for assistance. Information on
upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: IBM PureApplication System is affected by a vulnerability
in VMWare component (CVE-2018-6974)
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux, Windows
Software edition:
All Editions
Reference #:
0795276
Modified date:
25 January 2019
Summary
A vulnerability is reported in the VMWare component, and this component is
used by IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM
PureApplication System, in response to CVE-2018-6974. IBM PureApplication
System has addressed the applicable CVE.
Vulnerability Details
CVEID: CVE-2018-6974 DESCRIPTION: VMware ESXi, Workstation, and Fusion could
allow a remote attacker to execute arbitrary code on the system, caused by an
out-of-bounds read in SVGA device. By sending a specially-crafted request, an
attacker could exploit this vulnerability to execute arbitrary code on the
system.
CVSS Base Score: 9.8
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/151361 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
The solution is to upgrade the IBM PureApplication System to the following
fix pack release: IBM PureApplication V2.2.5.3 IBM recommends upgrading to a
fixed version of the product. Contact IBM for assistance. Information on
upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: IBM PureApplication System is affected by vulnerabilities
in VMWare component (CVE-2018-6981 CVE-2018-6982)
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux, Windows
Software edition:
All Editions
Reference #:
0795272
Modified date:
25 January 2019
Summary
There are vulnerabilities reported in the VMWare component that is used by
IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM
PureApplication System, in response to CVE-2018-6981 and CVE-2018-6982. The
following vulnerabilities have been addressed by IBM PureApplication System.
Vulnerability Details
CVEID: CVE-2018-6981 DESCRIPTION: VMware ESXi, Workstation, and Fusion could
allow a remote attacker to execute arbitrary code on the system, caused by an
issue with uninitialized stack memory usage in the vmxnet3 virtual network
adapter. If vmxnet3 is enabled, an attacker could exploit this vulnerability
to execute arbitrary code and gain elevated privileges on the host system.
CVSS Base Score: 10
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/152791 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVEID: CVE-2018-6982 DESCRIPTION: VMware ESXi, Workstation, and Fusion could
allow a remote attacker to obtain sensitive information, caused by an issue
with uninitialized stack memory usage in the vmxnet3 virtual network adapter.
If vmxnet3 is enabled, an attacker could exploit this vulnerability to obtain
sensitive information leaked from the host to the guest domain.
CVSS Base
Score: 8.6
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/152792 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
The solution is to upgrade the IBM PureApplication System to the following
fix pack release: IBM PureApplication V2.2.5.3 IBM recommends upgrading to a
fixed version of the product. Contact IBM for assistance. Information on
upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: Multiple Foreshadow Spectre Variant vulnerabilities affect
IBM OS Image for Red Hat Linux Systems in IBM PureApplication System
(CVE-2018-3615 CVE-2018-3620 CVE-2018-3646)
Security Bulletin
Document information
More support for:
PureApplication Service
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux, Windows
Software edition:
All Editions
Reference #:
0794637
Modified date:
25 January 2019
Summary
There are multiple vulnerabilities that affect the IBM OS Image for Red Hat
Linux Systems in IBM PureApplication System. IBM has released Version 2.2.5.3
for IBM PureApplication System, in response to CVE-2018-3615, CVE-2018-3620,
and CVE-2018-3646. The products that are identified for this support are: -
PureApplication System - PureApplication Software - PureApplication Service
IBM OS Image for Red Hat Linux Systems has addressed the following
vulnerabilities.
Vulnerability Details
CVEID: CVE-2018-3646 DESCRIPTION: Multiple Intel CPU's could allow a local
attacker to obtain sensitive information, caused by a flaw in the CPU
speculative branch instruction execution feature. By conducting targeted
cache side-channel attacks and via a terminal page fault, an attacker with
guest OS privilege could exploit this vulnerability to leak information
residing in the L1 data cache and read data belonging to different security
contexts.
CVSS Base Score: 7.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/148319 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-3615 DESCRIPTION: Multiple Intel CPU's could allow a local
attacker to obtain sensitive information, caused by a flaw in the CPU
speculative branch instruction execution feature and Intel software guard
extensions (Intel SGX). By conducting targeted cache side-channel attacks, an
attacker could exploit this vulnerability to leak information residing in the
L1 data cache from an enclave and read data belonging to different security
contexts.
CVSS Base Score: 7.9
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/148320 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)
CVEID: CVE-2018-3620 DESCRIPTION: Multiple Intel CPU's could allow a local
attacker to obtain sensitive information, caused by a flaw in the CPU
speculative branch instruction execution feature. By conducting targeted
cache side-channel attacks and via a terminal page fault, an attacker could
exploit this vulnerability to leak information residing in the L1 data cache
and read data belonging to different security contexts. Note: This
vulnerability is also known as the "L1 Terminal Fault (L1TF)" or "Foreshadow"
attack.
CVSS Base Score: 7.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/148318 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
IBM PureApplication V2.2.5.3
Contact IBM for assistance.
Information on upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM
PureApplication System (July and October 2018 updates)
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
AIX, Linux, Windows
Software edition:
All Editions
Reference #:
0795181
Modified date:
25 January 2019
Summary
There are multiple vulnerabilities in IBM(R) SDK Java(TM) Technology Edition,
Version 6 and 7, used by the IBM PureApplication System. These issues were
disclosed as part of the IBM Java SDK quarterly updates in July and October
2018, and the following vulnerabilities have been addressed.
Vulnerability Details
CVEID:
CVE-2018-2952
DESCRIPTION: An unspecified vulnerability related to the Java SE Concurrency
component could allow an unauthenticated attacker to cause a denial of
service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/146815 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:
CVE-2018-3136
DESCRIPTION:
An unspecified vulnerability related to the Java SE Security component could
allow an unauthenticated attacker to cause no confidentiality impact, low
integrity impact, and no availability impact.
CVSS Base Score: 3.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/151452
for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N)
CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability in related to
the Java SE Networking component could allow an unauthenticated attacker to
obtain sensitive information resulting in a low confidentiality impact using
unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/151455 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability related to the
Java SE JSSE component could allow an unauthenticated attacker to cause low
confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 5.6
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/151497 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID: CVE-2018-3214 DESCRIPTION: An unspecified vulnerability related to the
Java SE Sound component could allow an unauthenticated attacker to cause a
denial of service resulting in a low availability impact using unknown attack
vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/151530 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-13785 DESCRIPTION: libpng is vulnerable to a denial of
service, caused by a wrong calculation of row_factor in the
png_check_chunk_length function in pngrutil.c. By persuading a victim to open
a specially-crafted file, a remote attacker could exploit this vulnerability
to cause a denial of service condition.
CVSS Base Score: 5.5
CVSS Temporal
Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/146015 for
the current score
CVSS Environmental Score*: Undefined
CVSS Vector:
(CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
The PureSystems(R) Managers on IBM PureApplication System is affected.
Visit IBM Fix Central to download the fixes for AIX, Linux, or Windows.
Alternatively, the solution is to upgrade the IBM PureApplication System to
the following fix level: IBM PureApplication System V2.2.5.3 IBM recommends
upgrading to a fixed, supported version of the product. Contact IBM for
assistance.
Information on upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
IBM Java SDK Security Bulletin (July updates)
IBM Java SDK Security Bulletin (October updates)
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Security Bulletin: Public disclosed GNU glibc vulnerabilities used by IBM OS
Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-16997
CVE-2018-1000001)
Security Bulletin
Document information
More support for:
PureApplication System
Component:
Security
Software version:
2.2.2.0, 2.2.2.1, 2.2.2.2, 2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0,
2.2.5.1, 2.2.5.2, 2.2.5.3
Operating system(s):
Linux
Software edition:
All editions
Reference #:
0795270
Modified date:
25 January 2019
Summary
There are public disclosed vulnerabilities from GNU glibc that are used by
the OS Images for IBM PureApplication System. To address the vulnerabilities
in response to CVE-2017-16997 and CVE-2018-1000001, IBM has released Version
2.2.5.3 for IBM PureApplication System, which includes IBM OS images for Red
Hat Linux Systems based deployments.
Vulnerability Details
CVEID: CVE-2017-16997 DESCRIPTION: GNU C Library could allow a local attacker
to gain elevated privileges on the system, caused by a flaw in the elf/dl-
load.c. By using a Trojan horse library, an attacker could exploit this
vulnerability to gain elevated privileges on the system.
CVSS Base Score: 8.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136491 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-1000001 DESCRIPTION: Glibc could allow a local attacker to
execute arbitrary code on the system, caused by a buffer underflow in the
__realpath() function in stdlib/canonicalize.c. An attacker could exploit
this vulnerability to execute arbitrary code on the system and obtain
privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137516 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
For IBM PureApplication:
IBM OS Image for Red Hat Linux Systems 3.0.8.0 IBM OS Image for Red Hat Linux
Systems 3.0.9.0
For IBM PureApplication:
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
Note : Upgrade to at least IBM PureApplication System V2.2.5.0. Visit IBM Fix
Central to download the fixes for Linux.
Alternatively, for CVE-2018-1000001, the solution is to upgrade the IBM
PureApplication System to the following fix level:
Information on upgrading can be found here:
http://www-01.ibm.com/support/docview.wss?uid=swg27039159
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
Reference
Complete CVSS v3 Guide On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog
Change History
January 25, 2019: Original document published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT
WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE
IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXE/TPWaOgq3Tt24GAQjN1A//ZZ+seAVv62e1iF44xZDfbKiyFtoiPYa0
rb5kY1aAxS5CT2hy6kExAGxQZbmAkkxBdTQHF2EtJ4lnvj6Kv1mnrDyRytnIAKjh
Yuj5DSYb3AxolB/Kjlu3rb0kbvLLBlZSfaURuTCwsOx0A98/9z4IcIoep9XrEUb+
Nsh0NduSRvmtFyNi31eKatag52tebCemU4WrWPj9tphThKqt8O88ezKw10GPxhZJ
1vRHcFFywQD207wejMpzhKQbcBJYsnsCA2Op5wPb/VuUkDHQGCKTFLV4UY0nj+3U
SgyHzA2D+vV2wGn06AeQ6SqXm4+yAVp/n9qOk2avEMkA2kwtkm3zZ9RSZ2Oatq9N
CZFvhX0SuALKbA5/ChFmhN5vP3kyDByHUJb+cDRHb5Vgf0U2WodFGM5ZQUHh96Ch
66rXDvWrboO+RzcIZSbNbPbBQlXZWiBvOdD+Bqqnl6N8TsWtyCbo+XldU30Itlcb
1ypVjDcgoQ0iMOrUN1+ULcCbuMmuEJ+zzg563fLjSqEbZzsc7vHjcYR6wVn8oy4S
tRJHFFPyVY6ZVIK9IhtO2BtlEtfuO8fR2lemSxuGuJHj79+GyvFv1BfyZQ5aZwP1
ZiUDQaphVuMLE2eiLbEm3V/eoxCwaFSCyiL0uwx9PPwPn84Dw7ARgAR8vUQbYXOb
kGYqU8Ho3XY=
=Ewrs
-----END PGP SIGNATURE-----