Multiple vulnerabilities in IBM Spectrum Protect Plus

Published: 2022-07-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2021-20254 CVE-2021-3712 CVE-2021-43859 CVE-2022-0778 CVE-2020-25717 CVE-2021-23192 CVE-2021-3733
CWE-ID	CWE-125 CWE-400 CWE-835 CWE-264 CWE-20 CWE-399
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #4 is available.
Vulnerable software Subscribe	IBM Spectrum Protect Plus Server applications / Other server solutions
Vendor	IBM Corporation

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU52748

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-20254

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when mapping Windows group identities (SIDs) into unix group identities (gids), which resulted into negative idmap cache entries created in the Samba server process token. An attacker who can manage to trigger the vulnerability can crash the Samba server or potentially perform unauthorized actions on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Out-of-bounds read

EUVDB-ID: #VU56064

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3712

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing ASN.1 strings related to a confusion with NULL termination of strings in array. A remote attacker can pass specially crafted data to the application to trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Resource exhaustion

EUVDB-ID: #VU60527

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-43859

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Infinite loop

EUVDB-ID: #VU61391

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-0778

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU58097

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-25717

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the Windows Active Directory (AD) domains have by default a feature to allow users to create computer accounts. A remote authenticated attacker can create such account with elevated privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Input validation error

EUVDB-ID: #VU58091

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-23192

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the DCE/RPC fragment injection issue. A remote attacker can replace subsequent fragments in requests with their own data and alter the server behavior.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Resource management error

EUVDB-ID: #VU58295

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-3733

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application within the AbstractBasicAuthHandler class in urllib. A remote attacker with control over the server can perform regular expression denial of service attack during authentication.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.10.2

CPE2.3

cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.10.0:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/6596981

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?