Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2590
Vulnerabilities affect IBM Integrated Analytics System
12 July 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Integrated Analytics System
Publisher: IBM
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Privileged Data -- Existing Account
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-11091 CVE-2018-12130 CVE-2018-12127
CVE-2018-12126
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10958697
http://www.ibm.com/support/docview.wss?uid=ibm10958693
Comment: This bulletin contains two (2) IBM security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Vulnerabilities in Intel CPUs affect IBM Integrated Analytics System
Product: IBM Integrated Analytics System
Software version: All Versions
Operating system(s): Platform Independent
Reference #: 0958697
Security Bulletin
Summary
Potential security vulnerabilities in CPUs may allow information disclosure.
Intel released Microcode Updates (MCU) updates to mitigate this potential
vulnerability. IBM Integrated Analytics System has addressed the applicable
CVE.
Vulnerability Details
CVEID: CVE-2019-11091
DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to
obtain sensitive information, caused by a Microarchitectural Data Sampling
Uncacheable Memory (MDSUM) vulnerability that allows uncacheable memory on some
microprocessors utilizing speculative execution. An attacker could exploit this
vulnerability using a side-channel attack to obtain data that is being
processed in the CPU by other apps. Note: This is called the Zombieload attack.
CVSS Base Score: 3.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
160993 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVEID: CVE-2018-12130
DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to
obtain sensitive information, caused by a Microarchitectural Data Sampling
(MDS) vulnerability that fills buffers on some microprocessors utilizing
speculative execution. An attacker could exploit this vulnerability using a
side-channel attack to obtain data that is being processed in the CPU by other
apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
160992 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12127
DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to
obtain sensitive information, caused by a Microarchitectural Data Sampling
(MDS) vulnerability that fills buffers on some microprocessors utilizing
speculative execution. An attacker could exploit this vulnerability using a
side-channel attack to obtain data that is being processed in the CPU by other
apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
160991 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12126
DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to
obtain sensitive information, caused by a Microarchitectural Data Sampling
(MDS) vulnerability that stores buffers on some microprocessors utilizing
speculative execution. An attacker could exploit this vulnerability using a
side-channel attack to obtain data that is being processed in the CPU by other
apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
160990 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected Products and Versions
o IBM Integrated Analytics System 1.0.0 - 1.0.17.0
Remediation/Fixes
Update to the following IBM Integrated Analytics Systemrelease :
+-------------------------------+--------+-----------------------+
| Product | VRMF |Remediation / First Fix|
+-------------------------------+--------+-----------------------+
|IBM Integrated Analytics System|1.0.18.0|Link to Fix Central |
+-------------------------------+--------+-----------------------+
Change History
10 July 2019: Original version published
- ---
Vulnerability in BIND affects IBM Integrated Analytics System
Product: IBM Integrated Analytics System
Software version: All Versions
Operating system(s): Platform Independent
Reference #: 0958693
Security Bulletin
Summary
Open Source BIND is used by IBM Integrated Analytics System. IBM Integrated
Analytics System has addressed the applicable CVE.
Vulnerability Details
CVEID: CVE-2018-5743
DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by a flaw
when setting the TCP client quota using the tcp-clients option. By sending a
specially-crafted request, a remote attacker could exploit this vulnerability
to cause the exhaustion of file descriptors.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
160127 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
o IBM Integrated Analytics System 1.0.0 - 1.0.17.0
Remediation/Fixes
Update to the following IBM Integrated Analytics Systemrelease :
+-------------------------------+--------+-----------------------+
| Product | VRMF |Remediation / First Fix|
+-------------------------------+--------+-----------------------+
|IBM Integrated Analytics System|1.0.18.0|Link to Fix Central |
+-------------------------------+--------+-----------------------+
Change History
11 July 2019: Original version published
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXSghsmaOgq3Tt24GAQjHAg//ZPYivINZCdMwqkOhEYEqGyFli8ooGzR8
Rsvx563W6jEDViBZZ0rVp+JzmxMNMbV92KjMyuVUzrXXJvg/Hidso7oZFHqsWG9U
zdmcZsL7lF8ZK4OG8uAkmAHkaYqyK2kxlB9iN7iwM7p5YEaYhO/mttqeU69kLZ78
DeM6LPbzTHEgghRuyA+rqXH096SDpQVTMX8thFg7IQQLCyboS7NyGLa4HY5qKxEj
jCvdBwRAHtBsFhFLEWloA+rcjNpg7tO6j8FtHS7aB+Mr/Rziuubt95NoimWZv8aU
YqINQXqQ6CFdUjIe9cSryUYCuxkz8CP2pgWEbBOJ/yUa4zCI7JmKK7glJ3rcQ/jQ
PL4hqZgBt+RnQGa+Vg5aEP3MRY60QkYQaltQD4gEhN70TDBwLWGojHKPpJGeQeLm
Q92kR81xQp6+nyXN9DQDCppuC+zPF/9AHLeuDRDyOqKHhK2D8ico7JSb4OS6jWm3
TCvCiHhPZQ3xAY+VwBWtj5OT3L5Wf5m5yx00UrruaIX+/kXlkJHyzN/j0lKl16c1
8MzY7Na7oYiAFi4cwXky3DRAb7WxCgyKwLhGTwA+ljc1d3KeTtlAxc/Lbaf63sH9
QqUlctIrVslJwKwkQwitbOaKmqlsBr8FwtbrWuoTyoQ8531RZud55UhybYd5sB9e
vbaGbiMRSvo=
=qMxf
-----END PGP SIGNATURE-----