Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus

1) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU62767

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1434

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists in OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite due to incorrect usage of AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker can perform a man-in-the-middle (MitM) attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Integration Bus: 10.0.0.0 - 10.0.0.26

IBM App Connect Enterprise: 11.0.0.0 - 12.0.4.0

External links

http://www.ibm.com/support/pages/node/6601123

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security features bypass

EUVDB-ID: #VU62766

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1343

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when validating OCSP response within the OCSP_basic_verify function. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. A remote attacker can perform MitM attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Integration Bus: 10.0.0.0 - 10.0.0.26

IBM App Connect Enterprise: 11.0.0.0 - 12.0.4.0

External links

http://www.ibm.com/support/pages/node/6601123

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Uncontrolled Memory Allocation

EUVDB-ID: #VU62768

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1473

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to memory reuse is not possible in the OPENSSL_LH_flush() function, which empties a hash table when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Integration Bus: 10.0.0.0 - 10.0.0.26

IBM App Connect Enterprise: 11.0.0.0 - 12.0.4.0

External links

http://www.ibm.com/support/pages/node/6601123

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.