SB2022072128 - Multiple vulnerabilities in IBM PureData System for Operational Analytics
Published: July 21, 2022 Updated: October 22, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 secuirty vulnerabilities.
1) Protection mechanism failure (CVE-ID: CVE-2019-10086)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exist due to Beanutils is not using by default the a special BeanIntrospector class in PropertyUtilsBean that was supposed to suppress the ability for an attacker to access the classloader via the class property available on all Java objects. A remote attacker can abuse such application behavior against applications that were developed to rely on this security feature.
2) Cryptographic issues (CVE-ID: CVE-2017-12974)
The vulnerability allows a remote attacker to conduct a padding oracle attack.
The vulnerability exists due to Nimbus JOSE+JWT proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve. A remote attacker can conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.
3) Resource management error (CVE-ID: CVE-2014-0193)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
4) Input validation error (CVE-ID: CVE-2015-2156)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
5) Buffer overflow (CVE-ID: CVE-2014-3488)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
6) Improper access control (CVE-ID: CVE-2019-0201)
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions when "getACL()" command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. A remote attacker can gain READ permissions to list ACL.
7) Improper input validation (CVE-ID: CVE-2017-18640)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Application Server (SnakeYAML) component in PeopleSoft Enterprise PT PeopleTools. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
8) Input validation error (CVE-ID: CVE-2019-17195)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to Nimbus JOSE+JWT throws various uncaught exceptions while parsing a JWT. A remote attacker can send a specially crafted JWT token and cause the application to crash or potentially bypass authentication.
9) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2019-16869)
The vulnerability allows a remote attacker to perform HTTP request smuggling attack.
The vulnerability exists due to improper input validation when processing a whitespace before the colon in HTTP headers (e.g. "Transfer-Encoding : chunked"). A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.
10) Resource management error (CVE-ID: CVE-2019-12402)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the file name encoding algorithm can get into an infinite loop when faced with
specially crafted inputs. A remote attacker can choose the file names inside of an archive created by Compress and cause a denial of service condition on the target system.
11) Deserialization of Untrusted Data (CVE-ID: CVE-2019-17571)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data within the SocketServer class in Log4j. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system, if these is a deserialization gadget listening to untrusted network traffic for log data.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) XML External Entity injection (CVE-ID: CVE-2019-10172)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
13) Input validation error (CVE-ID: CVE-2019-10202)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to incorrect implementation of patch for Codehaus 1.9.x against insufficient data deserialization present in FasterXML jackson-databind. A remote attacker can bypass implemented protection measures and exploit known deserialization vulnerabilities in jackson-databind package.14) Unsafe reflection (CVE-ID: CVE-2014-0114)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to Apache Commons BeanUtils does not suppress the class property. A remote unauthenticated attacker can manipulate the ClassLoader and execute arbitrary code via the class parameter
15) Cryptographic issues (CVE-ID: CVE-2017-12973)
The vulnerability allows a remote attacker to conduct a padding oracle attack.
the vulnerability exists due to improper validation of HMAC in authenticated AES-CBC decryption in Nimbus JOSE+JWT. A remote attacker can conduct a padding oracle attack.
16) Resource exhaustion (CVE-ID: CVE-2019-9518)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of user-supplied input within the HTTP.sys driver when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.
17) Resource management error (CVE-ID: CVE-2019-9515)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in HTTP/2 implementation when processing SETTINGS frames. A remote attacker can send a huge amount of SETTINGS frames to the peer and consume excessive CPU and memory on the system.
18) Resource exhaustion (CVE-ID: CVE-2019-9514)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.
19) Resource exhaustion (CVE-ID: CVE-2019-9512)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.
20) Heap-based buffer overflow (CVE-ID: CVE-2009-0001)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in Apple QuickTime. A remote attacker can use a crafted RTSP URL to trigger a heap-based buffer overflow and execute arbitrary code on the target system.
21) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2016-2402)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to an unspecified error. A remote attacker can send a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate to bypass certificate pinning.
22) Path traversal (CVE-ID: CVE-2018-8009)
The vulnerability allows a remote attacker to conduct a directory traversal attack on the target system.
The vulnerability exists due to improper validation of files inside an archive file. A remote unauthenticated attacker can trick the victim into extracting a zip file that contains files that use directory traversal characters, cause a malicious file to be created outside the current working directory and cause a denial of service (DoS) condition or execute arbitrary code by overwriting other files on the system.
Successful exploitation of the vulnerability may result in system compromise.
Note: the vulnerability has been dubbed "Zip Slip".
23) Uncontrolled memory allocation (CVE-ID: CVE-2018-10237)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to unbounded memory allocation. A remote attacker can cause the service to crash and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
24) Improper input validation (CVE-ID: CVE-2018-11771)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an error when processing malicious input. A remote attacker can trick the victim into processing a specially crafted ZIP archive with 'java.io.InputStreamReader', trigger an error in detecting the end of the file and cause the service to crash.
25) Improper access control (CVE-ID: CVE-2017-5637)
The vulnerability allows a local user to perform a denial of service attack.The vulnerability exists due to improper access constrictions to wchp/wchc service. A local user can consume all available CPU resource and perform denial of service (DoS) attack.
26) Improper authentication (CVE-ID: CVE-2018-8012)
The vulnerability allows a remote attacker to bypass authentication and write arbitrary files on the target system.The weakness exists due to missing authentication to join a quorum. A remote attacker can bypass authentication, join the cluster and propagate changes to the cluster leader.
27) Integer overflow (CVE-ID: CVE-2017-12972)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to integer overflow when converting length values from bytes to bits in Nimbus JOSE+JWT. A remote attacker can shift Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC, trigger integer overflow and bypass HMAC authentication.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.
References
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/"
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/</a><br><a
- https://www.ibm.com/support/pages/node/6605881"
- https://www.ibm.com/support/pages/node/6605881</a><br><br><br></p>