The official site for Saudi CERT
IBM Updates
1931
Warning Date
Severity Level
Warning Number
Target Sector
16 August, 2020
● High
2020-1642
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- WebSphere Application Server
- 9.0
- 8.5
- 8.0
- 7.0
- IBM Event Streams
- 10.0.0
- WebSphere Service Registry and Repository V8.5
- WebSphere Service Registry and Repository Studio V8.5
- Netcool Operations Insight – Cloud Native Event Analytics
- 1.6.0
- IBM Network Performance Insight
- 1.3
- 1.3.1
- TNPM
- 1.4.x
- SAN Volume Controller and Storwize Family
- 8.3
- Financial Transaction Manager for ACH Services for Multi-Platform
- 3.1.0.0 – 3.1.0.3
- 3.0.6.0 – 3.0.6.11
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Information disclosure.
- Execute arbitrary code remotely.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-server-is-vulnerable-to-a-remote-code-execution-vulnerability-cve-2020-4589-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-exists-in-the-event-streams-10-0-0-schema-registry-that-allows-unauthorised-access-to-create-edit-and-delete-schemas-cve-2020-4662/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-websphere-service-registry-and-repository-and-websphere-service-registry-and-repository-studio-july-2020-cpu-plus-deferred-cve/
- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-cloud-native-event-analytics-is-affected-by-a-international-components-for-unicode-icu-for-c-c-vulnerability-cve-2020-10531/
- https://www.ibm.com/blogs/psirt/security-bulletin-jackson-databind-publicly-disclosed-vulnerability-found-in-network-performance-insight-cve-2020-8840/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-runtime-may-affect-tivoli-netcool-performance-manager-for-wirelessoracle-january-2020-cpu/
- https://www.ibm.com/blogs/psirt/security-bulletin-ldap-vulnerability-affects-ibm-san-volume-controller-ibm-storwize-ibm-spectrum-virtualize-and-ibm-flashsystem-products/
- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-manager-for-ach-services-is-affected-by-a-potential-information-disclosure-id-177835/
Rate the content
Share the page
