Use of cryptographically weak PRNG in IBM DB2 - CVE-2018-1426

Vulnerability identifier: #VU12311

CSH Severity: Low

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1426

CWE-ID: CWE-338

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists due to IBM GSKit duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which can result in duplicate Session IDs and a risk of duplicate key material. A remote attacker can gain access to potentially sensitive information and write arbitrary files.

IBM DB2
Planning Analytics Local
IBM Cognos Analytics
IBM Algo One Core
IBM Cognos Controller
Security Network Protection
IBM Tivoli Directory Server
IBM MQ
Tivoli Network Manager IP Edition

Install update from vendor's website.

IBM Cognos Analytics - update to 11.0.13
Tivoli Network Manager IP Edition - addressed in versions 3.9.0.132, 4.1.1.49, 4.2.0.5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/139071

• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Security Network Protection
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in IBM Algo One Core
• Multiple vulnerabilities in IBM Planning Analytics Local
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Tivoli Directory
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition