Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2057
IBM API Connect V5 is impacted by Cross Site Scripting vulnerability
(CVE-2016-10531 CVE-2018-3721 CVE-2017-0268)
10 June 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM API Connect
Publisher: IBM
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-3721 CVE-2017-0268 CVE-2016-10531
Reference: ASB-2017.0073
ESB-2019.1524
ESB-2019.1121
ESB-2018.1183
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10885478
- --------------------------BEGIN INCLUDED TEXT--------------------
IBM API Connect V5 is impacted by Cross Site Scripting vulnerability
(CVE-2016-10531 CVE-2018-3721 CVE-2017-0268)
Product: IBM API Connect
Software version: 5.0.0.0-5.0.8.6
Operating system(s): Platform Independent
Reference #: 0885478
Security Bulletin
Summary
API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID: CVE-2017-0268
DESCRIPTION: Microsoft Server Message Block 1.0 (SMBv1) could allow a remote
attacker to obtain sensitive information, caused by improper handling of
incoming requests. By sending specially-crafted packet data to the server, a
remote attacker could exploit this vulnerability to obtain sensitive
information.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
125554 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-3721
DESCRIPTION: Node.js lodash module could allow a remote attacker to bypass
security restrictions, caused by a flaw in the defaultsDeep, 'merge, and
mergeWith functions. By modifing the prototype of Object, an attacker could
exploit this vulnerability to add or modify existing property that will exist
on all objects.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
144603 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2016-10531
DESCRIPTION: Node.js marked module is vulnerable to cross-site scripting,
caused by improper validation of user-supplied input by the link components. A
remote attacker could exploit this vulnerability to inject malicious script
into a Web page which would be executed in a victim's Web browser within the
security context of the hosting Web site, once the page is viewed. An attacker
could use this vulnerability to steal the victim's cookie-based authentication
credentials.
CVSS Base Score: 6.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
149101 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
+---------------------------+-----------------+
|Affected IBM API Management|Affected Versions|
+---------------------------+-----------------+
|IBM API Connect |5.0.0.0-5.0.8.6 |
+---------------------------+-----------------+
Remediation/Fixes
+----------------+-------+-------+--------------------------------------------+
|Affected Product| Fixed | APAR | Remediation / First Fix |
| |in VRMF| | |
+----------------+-------+-------+--------------------------------------------+
| | | |Addressed in IBM API Connect V5.0.8.6iFix. |
| | | | |
| | | |Management server is impacted. |
| | | | |
|IBM API Connect |5.0.8.6|LI80859|Follow this link and find the appropriate |
|V5.0.0.0-5.0.8.6|iFix | |package: |
| | | |http://www.ibm.com/support/fixcentral/swg/ |
| | | |quickorderparent=ibm%7EWebSphere&product= |
| | | |ibm/WebSphere/IBM+API+Connect&release= |
| | | |5.0.8.6&platform=All&function=all&source=fc |
+----------------+-------+-------+--------------------------------------------+
Workarounds and Mitigations
None
Change History
June 6, 2019: Original bulletin published
Product Alias/Synonym
API Connect
APIC
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXP2aEmaOgq3Tt24GAQjJEhAAm9CNyOnRMMB/C16gAMbcf6ahfXCemRCk
tXAsoKQFAHthhd/QS2/pJXSDy8VLjfTd1qxJCKMQWtGBxtf6MPwLksFBqMa1LLV6
Qj0JUsZXf1N9JH92h+XdTUlh2jAT8QgVSwYmUWL1KrHlf450NMf68jwml+YBhQFz
yhChIT62IjDD/JmWiVrL+xghW3mv+4elc6BM5cLKy5ZRqYFFcOWH9uPpB2dMMlHw
65HjvECdPtBPvpx6qdAYF3B2M1nxjzZl2AjMEbGfgsSG9+gCywRsPnJYHLbXcWOv
uMxWBs2DeNR/L1mtLJVe1CDN3GL9lxdt9mAj9Xf7t9hPWq0o67VSiMbWPHkjbZ6d
wi6sNOYv3CVs3zrpvURUUQy/EEEMDY66NEAAjRICpFCS9V05CxBTr0BklJLM/KpN
JNlPJLOIENORiiiNxMJsNvIh/CFEj/JVkdY3BqUk3I9wJfMQPcMna/qvVTCD6A5O
nh1xnLvGj/rwbMeXxCs7ErXE7kWv+bT3UmsWQ3QTDYYc3ZTU3zRmUzF9NeVe7f27
giy4Dr9z/hb/ThJMMktBYINwkV9nGjY/eA9LoZvNrBIs8bZWUbwBJA3vVrTys+Q7
qbKzWenHCjdGBmvGPjoDgfEkq7ct6zXyn2dTRaflhOE8rB5j4zdCZlHvdHWwzCXD
63mKzOJaSRs=
=clsi
-----END PGP SIGNATURE-----