Multiple vulnerabilities in SAN Volume Controller, Storwize family and FlashSystem V9000 products



Published: 2017-05-08 | Updated: 2023-07-17
Risk Medium
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2016-2177
CVE-2016-2178
CVE-2016-2183
CVE-2016-6302
CVE-2016-6304
CVE-2016-6306
CWE-ID CWE-119
CWE-494
CWE-203
CWE-327
CWE-125
CWE-400
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
Subscribe 		IBM Storwize V3500
Hardware solutions / Other hardware appliances

IBM Storwize V3700
Hardware solutions / Other hardware appliances

IBM Storwize V5000
Hardware solutions / Other hardware appliances

IBM Storwize V7000
Hardware solutions / Other hardware appliances

IBM FlashSystem V9000
Hardware solutions / Other hardware appliances

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Integer overflow in ssl3_get_client_hello()

EUVDB-ID: #VU24

Risk: Medium

CVSSv3.1: 4.6 [AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2177

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause denial of service conditions on the target system.
The vulnerability exists due to a boundary error in ssl3_get_client_hello() function. A remote attacker can cause integer overflow by sending specially crafted data and crash the service.
Successful exploitation of this vulnerability may cause the target service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Observable discrepancy

EUVDB-ID: #VU1589

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2178

CWE-ID: CWE-203 - Observable discrepancy

Exploit availability: No

Description

The vulnerability allows a local user to perform timing attack.

The vulnerability exists due to an error within the dsa_sign_setup() function in crypto/dsa/dsa_ossl.c. A local user can obtain a DSA private key via a timing side-channel attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU370

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2016-2183

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt transmitted data.

The vulnerability exists due to remote user's ability to control the network and capture long duration 3DES CBC mode encrypted session during which he can see a part of the text. In case of repeated sending the attacker can read the part and reconstruct the whole text.

Successful exploitation of this vulnerability may allow a remote attacker to decode transmitted data. This vulnerability is known as SWEET32.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Out-of-bounds read

EUVDB-ID: #VU814

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6302

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when handling SHA512 TLS session tickets. A remote attacker can send specially crafted packets to the system, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU646

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6304

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper resource management in OCSP stapling implementation in OpenSSL. A remote attacker can multiple requests with a large OCSP Status Request extension and consume all available memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Denial of service

EUVDB-ID: #VU816

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6306

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakess exists due insufficient length validation of certain TLS/SSL protocol handshake messages. By causing out-of-bounds read error attackers can trigger the affected service deny.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Storwize V3500: before 7.8.1.0

IBM Storwize V3700: before 7.8.1.0

IBM Storwize V5000: before 7.8.1.0

IBM Storwize V7000: before 7.8.1.0

IBM FlashSystem V9000: before 7.8.1.0

External links

http://www.ibm.com/support/pages/node/697175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###