IBM Updates
2806Warning Date
Severity Level
Warning Number
Target Sector
18 August, 2020
● Medium
2020-1647
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- WebSphere Cast Iron
- 7.5.0.0
- 7.5.0.1
- 7.5.1.0
- 7.0.0.0
- 7.0.0.1
- 7.0.0.2
- App Connect Professional
- 7.5.2.0
- 7.5.3.0
- Capilano (Installation Manager)
- 1.9.x
- IBM Netezza Host Management
- 5.4.9.0 – 5.4.28.0
- The Elastic Storage Server
- 5.3.0 - 5.3.6
- 5.0.0 - 5.2.9
- 4.5.0 - 4.6.0
- 4.0.0 - 4.0.6
- IBM Platform Symphony
- 7.1 Fix Pack 1
- IBM Spectrum Protect Plus
- 10.1.0-10.1.6
- SAN Volume Controller and Storwize Family
- 8.3.1
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Denial of service (DoS).
- Decrypt highly sensitive information.
- Escalate their privileges.
- Execute arbitrary code as a root user.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-java-sdk-affect-ibm-websphere-cast-iron-solution-app-connect-professional/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-java-runtime-affects-ibm-installation-manager-and-ibm-packaging-utility-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-elastic-storage-server-is-affected-by-a-vulnerability-where-an-unprivileged-user-could-execute-commands-as-root-cve-2020-4273/
- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulnerability-from-kernel-affects-ibm-netezza-host-management-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-an-older-version-of-a-batik-plugin-that-is-included-in-ibm-installation-manager-and-ibm-packaging-utility/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-tomcat-affects-ibm-platform-symphony-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-elastic-storage-server-gui-is-affected-by-verbose-error-messages-being-displayed/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-identified-in-ibm-elastic-storage-server-gui-where-an-unauthorised-user-can-execute-commands-cve-2020-4348/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-elastic-storage-server-gui-is-affected-by-weak-cryptographic-algorithms/
- https://www.ibm.com/blogs/psirt/security-bulletin-ldap-vulnerability-affects-ibm-san-volume-controller-ibm-storwize-ibm-spectrum-virtualize-and-ibm-flashsystem-products-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-java-sdk-affect-app-connect-professional/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-elastic-storage-server-gui-is-affected-by-weak-cryptographic-algorithm-cve-2020-4349/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-java-sdk-affects-in-ibm-elastic-storage-server-cve-2020-2654/