Multiple vulnerabilities in IBM System Storage Virtualization Engine TS7700



Published: 2024-10-02
Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2024-25016
CVE-2024-31919
CVE-2024-35116
CVE-2024-31912
CVE-2024-25048
CWE-ID CWE-20
CWE-388
CWE-264
CWE-122
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		IBM Virtualization Engine TS7700 3948-VED
Other software / Other software solutions

Virtualization Engine TS7700 3957-VED
Hardware solutions / Firmware

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU87128

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25016

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect buffering logic. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Virtualization Engine TS7700 3948-VED: before 8.54.1.27 VTD_EXEC.405

Virtualization Engine TS7700 3957-VED: before 8.54.1.27 VTD_EXEC.405

CPE2.3
External links

http://www.ibm.com/support/pages/node/7171828


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper error handling

EUVDB-ID: #VU93444

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31919

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error caused by an error processing messages when an API Exit using MQBUFMH is used. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Virtualization Engine TS7700 3948-VED: before 8.54.1.27 VTD_EXEC.405

Virtualization Engine TS7700 3957-VED: before 8.54.1.27 VTD_EXEC.405

CPE2.3
External links

http://www.ibm.com/support/pages/node/7171828


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper error handling

EUVDB-ID: #VU93442

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35116

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error applying configuration changes. A remote attacker can send specially crafted requests to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Virtualization Engine TS7700 3948-VED: before 8.54.1.27 VTD_EXEC.405

Virtualization Engine TS7700 3957-VED: before 8.54.1.27 VTD_EXEC.405

CPE2.3
External links

http://www.ibm.com/support/pages/node/7171828


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU93441

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31912

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Virtualization Engine TS7700 3948-VED: before 8.54.1.27 VTD_EXEC.405

Virtualization Engine TS7700 3957-VED: before 8.54.1.27 VTD_EXEC.405

CPE2.3
External links

http://www.ibm.com/support/pages/node/7171828


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Heap-based buffer overflow

EUVDB-ID: #VU89108

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25048

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper bounds checking. A remote attacker can overflow a buffer and execute arbitrary code on the system or cause the server to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Virtualization Engine TS7700 3948-VED: before 8.54.1.27 VTD_EXEC.405

Virtualization Engine TS7700 3957-VED: before 8.54.1.27 VTD_EXEC.405

CPE2.3
External links

http://www.ibm.com/support/pages/node/7171828


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###