Date: 30 July 2012
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
ASN.1 PARSING VULNERABILITY IN SOME DATAPOWER SERVICES AND COMMANDS
30 July 2012
AusCERT Security Bulletin Summary
Product: WebSphere DataPower SOA Appliances
Operating System: Network Appliance
Impact/Access: Denial of Service -- Remote/Unauthenticated
CVE Names: CVE-2012-2110
- --------------------------BEGIN INCLUDED TEXT--------------------
IC84088: ASN.1 PARSING VULNERABILITY IN SOME DATAPOWER SERVICES AND COMMANDS
Closed as program error.
An appliance restart or other unpredictable behavior can be
triggered by malicious ASN.1 content coming into the DataPower
appliance from a variety of entry points.
The problem can be externally triggered from malicious network
data entering services as follows:
- compressed or signed or encrypted messages entering a B2B
- signed or encrypted messages entering a service with a
cryptobin action set to verify or decrypt the messages
The problem can also be triggered from certain CLI commands (and
their WebGUI/SOMA equivalents):
- boot image (firmware upgrade action)
- certificate (Crypto Certificate configuration)
- crypto-import (action)
- decrypt (deprecated S/MIME file crypto action)
- key (Crypto Key configuration)
- verify (deprecated S/MIME file crypto action)
This problem can also be triggered by modifying the contents of
files used by existing Crypto Key and Crypto Certificate objects
(the new file will be read at the next firmware restart or
This problem is known as CVE-2012-2110.
Restrict access to the affected CLI commands. There is no local
fix for this problem in cryptobin and B2B Gateway services.
A vulnerability exists when parsing malicious improperly-formed
ASN.1 data. It can cause unpredictable results including an
Malicious data can enter the appliance from the network
when a service is configured to decrypt or perform
signature verification, as B2B AS1/AS2/AS3 messages to
be processed by a B2B Gateway, or as PKCX#7 or S/MIME
traffic to be processed by a cryptobin action. In addition,
various CLI commands that refer to ASN.1-encoded data can
potentially be entrypoints for malicious data.
This problem is known as CVE-2012-2110.
The fix is available in 22.214.171.124, 126.96.36.199 and 188.8.131.52.
Restrict access to the affected CLI commands (including commands
that can modify ASN.1 data referenced by existing objects).
There is no temporary fix for the network entrypoints.
APAR number IC84088
Reported component name DATAPOWER
Reported component ID DP1234567
Reported release 402
Status CLOSED PER
Special Attention NoSpecatt
Submitted date 2012-06-12
Closed date 2012-07-25
Last modified date 2012-07-25
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name DATAPOWER
Fixed component ID DP1234567
Applicable component levels
R382 PSY UP
R401 PSY UP
R402 PSY UP
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines
Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to email@example.com
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----