SB2022092207 - Multiple vulnerabilities in IBM Cloud Pak for Automation

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022092207

SB2022092207 - Multiple vulnerabilities in IBM Cloud Pak for Automation

Published: September 22, 2022

Security Bulletin ID SB2022092207
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 20% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Cleartext transmission of sensitive information (CVE-ID: CVE-2021-23018)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the services within the NGINX Controller namespace are using cleartext protocols inside the cluster. A remote attacker with ability to intercept network traffic can gain access to sensitive data.


2) Off-by-one (CVE-ID: CVE-2021-23017)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the ngx_resolver_copy() function when processing DNS responses. A remote attacker can trigger an off-by-one error, write a dot character (‘.’, 0x2E) out of bounds in a heap allocated buffer and execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is configured. A specially crafted packet allows overwriting the least significant byte of next heap chunk metadata with 0x2E.


3) Incorrect default permissions (CVE-ID: CVE-2021-23021)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for agent configuration file /etc/controller-agent/agent.conf. A local user with access to the system can obtain sensitive information, such as the API key.


4) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2021-23020)

The vulnerability allows a local user to bypass implemented security restrictions.

the vulnerability exists due to the NAAS API keys are generated using an insecure pseudo-random string and hashing algorithm. A local user can potentially generate a valid user key.


5) Cleartext storage of sensitive information (CVE-ID: CVE-2021-23019)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the NGINX Controller Administrator password is exposed via the
systemd.txt file that is included in the NGINX support package. An attacker, who can obtain the support package can retrieve administrator's password and gain unauthorized access to the system.


Remediation

Install update from vendor's website.

References