Description:

IBM has released security updates to address several vulnerabilities in several products, mainly:

• Apache HTTP Server
  • IBM QRadar SIEM 7.5.0 GA
  • IBM QRadar SIEM 7.4.3 GA – 7.4.3 Fix Pack 4
  • IBM QRadar SIEM 7.3.3 GA – 7.3.3 Fix Pack 10
• App Connect Enterprise Certified Container
• IBM RackSwitch firmware
• IBM HTTP Server
  • IBM i7.4
  • IBM i7.3
  • IBM i7.2
• IBM Sterling Connect
  • Direct for UNIX Certified Container6.2.0
  • Direct for UNIX Certified Container6.1.0
  • Direct for UNIX Certified Container6.0.0
• IBM Java SDK
• IBM Flex System switch firmware
• IBM Datacap
  • Datacap Taskmaster Capture9.1.8
  • Datacap Taskmaster Capture9.1.9

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Execute arbitrary code
• Denial of service attack (DoS)

Best practice and Recommendations:

The CERT team encourages users to review IBM security advisory and apply the necessary updates, mainly:

• https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/
• https://www.ibm.com/blogs/psirt/security-bulletin-apache-http-server-as-used-by-ibm-qradar-siem-is-vulnerable-to-buffer-overflow-and-denial-of-service-cve-2021-44790-cve-2021-34798-cve-2021-39275/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterprise-certified-container-dashboards-may-be-vulnerable-to-a-denial-of-service-vulnerability-due-to-ibm-x-force-vulnerability-220063/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-products-are-affected-by-vulnerabilities-in-openssl/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-http-server-powered-by-apache-for-i-is-vulnerable-to-cve-2021-44224/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-products-are-affected-by-vulnerabilities-in-libxml2-2/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-products-are-affected-by-vulnerabilities-in-libxml2-2/
• https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-virtualization-engine-ts7700-october-2021/
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-switch-firmware-products-are-affected-by-vulnerabilities-in-openssl/
• https://www.ibm.com/blogs/psirt/security-bulletin-due-to-use-of-apache-log4j-ibm-datacap-is-vulnerable-to-arbitrary-code-execution-cve-2021-4104/