Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.4191
Security Bulletin: IBM QRadar SIEM is vulnerable to Intel
Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126,
CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)
7 November 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM QRadar SIEM
Publisher: IBM
Operating System: Linux variants
Impact/Access: Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-11091 CVE-2018-12130 CVE-2018-12127
CVE-2018-12126
Reference: ASB-2019.0173
ASB-2019.0138
ESB-2019.4101
ESB-2019.3590
ESB-2019.3944.2
Original Bulletin:
https://www.ibm.com/support/pages/node/1103481
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: IBM QRadar SIEM is vulnerable to Intel Microarchitectural
Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127,
CVE-2018-12130, CVE-2019-11091)
Document Information
More support for:
IBM QRadar SIEM
Component:
Console
Software version:
7.2, 7.3
Operating system(s):
Linux
Software edition:
All Editions
Reference #:
1103481
Modified date:
06 November 2019
Security Bulletin
Summary
IBM QRadar SIEM is vulnerable to Intel Microarchitectural Data Sampling (MDS)
Vulnerabilites
Vulnerability Details
CVEID: CVE-2019-11091
DESCRIPTION: Microarchitectural Data Sampling Uncacheable Memory (MDSUM):
Uncacheable memory on some microprocessors utilizing speculative execution may
allow an authenticated user to potentially enable information disclosure via a
side channel with local access. A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf
CVSS Base score: 3.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
160993 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVEID: CVE-2018-12130
DESCRIPTION: Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill
buffers on some microprocessors utilizing speculative execution may allow an
authenticated user to potentially enable information disclosure via a side
channel with local access. A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
160992 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12127
DESCRIPTION: Microarchitectural Load Port Data Sampling (MLPDS): Load ports
on some microprocessors utilizing speculative execution may allow an
authenticated user to potentially enable information disclosure via a side
channel with local access. A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
160991 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12126
DESCRIPTION: Microarchitectural Store Buffer Data Sampling (MSBDS): Store
buffers on some microprocessors utilizing speculative execution may allow an
authenticated user to potentially enable information disclosure via a side
channel with local access. A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
160990 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected Products and Versions
. IBM QRadar 7.2.0 to 7.2.8 Patch 16
. IBM QRadar 7.3.0 to 7.3.2 Patch 4
Remediation/Fixes
IBM QRadar/QRM/QVM/QRIF/QNI 7.2.8 Patch 17
IBM QRadar/QRM/QVM/QRIF/QNI 7.3.2 Patch 5
Workarounds and Mitigations
Please note in order to fully mitigate CVE-2018-12126, CVE-2018-12127,
CVE-2018-12130, and CVE-2019-11091, microcode will need to be updated on all
appliances along with the Kernel update that is included in the QRadar Patch.
Please see the links below for available microcode updates.
For Lenovo Appliance M5 Firmware installs using ISO/IMM, see:
Lenovo x3550 M5 and Lenovo x3650 M5
For Lenovo M4 Appliance Firmware installs using USB keys, see:
1U USB: Qradar_IMG_M4_1U_MT7914_x3550_6_0_0
2U USB: Qradar_IMG_M4_2U_MT5466_x3650_6_0_0
For Lenovo M4 Appliance Firmware installs using ISO/IMM, see:
1U ISO: Qradar_M4_1U_MT7914_x3550_6_0_0
2U ISO: Qradar_M4_2U_MT5466_x3650_6_0_0
M3 appliances do not require a firmware update
Get Notified about Future Security Bulletins
Subscribe to My Notifications to be notified of important product support
alerts like this.
References
Complete CVSS v3 Guide
On-line Calculator v3
Off
Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Change History
05 Nov 2019: Initial Publication
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXcOfK2aOgq3Tt24GAQiB2Q//VH9yMQHSwhqnyYMQvvEsHOvwYKm8UC1Y
xNOXI25PsTE4TpFibInI/9Ds2o3M9rIt37LeeiAuUkaAeREFzc7NWZ17vqm3Ehyg
hZZOcg6d6z4f0bR2tRMkpCTWP6I74aB1w+yaZWvY+k0+QZYEE9eWrenJcTzH972L
Jc4BRaLSQSqQTAy4n1Dq1ayxe3DtJ1DF7lI5FKmyIIP2j/Gp+XgtirNaDQx21R12
R3KZlvNYFOt+ylFQ4CgIN+/pZYb9HD7tZs3k7EagySVxSanOdd6POu9GDA0EOs2c
D3C9gMzQfg6PCCvrMnZ/h4Q9IOhH/+DA3asUc3EjXRsMFWNKzat26bkgHiYonCBh
MFqGZZBqJoq3XK1XZv4JDpLjDTq/xGakyR4dUwyDEC9GU0cUn2YmOi+2gkHNHeTj
xYQtug3qMIvV9kjJpYiOQtQ7IomYIWWe4fBw7PsJOj3g7PqjF9UJ3ko9RjXHQ05x
kb/jUe1A/X0iun2MwolmJsN/NsqLdFUFRYCRfG9Az8eZgXIt61Bhwa1fv1eh2RhM
8/TqZv+2oYxXL+mDEZEgykNXwmJ45wcOqBewTOi7fAlJngoVYmApgj6zrcsBId72
hKEYktFYb0k7702fWqwfVjXBVWTwq7/V0u1oi+BZdt7hiesISebfOXCcY3Z3vsgP
hFBu8oE2aJQ=
=1lwg
-----END PGP SIGNATURE-----