Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2542.2
IBM Security Proventia Network Active Bypass is affected by
glibc vulnerabilities
29 August 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Security Network Active Bypass
Publisher: IBM
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1000001 CVE-2018-6485 CVE-2017-1000409
CVE-2017-1000408 CVE-2017-17426 CVE-2017-16997
CVE-2017-15804 CVE-2017-15671 CVE-2017-15670
CVE-2017-3738 CVE-2017-3737 CVE-2016-0701
CVE-2011-5320
Reference: ESB-2018.2516
ESB-2018.2199
ESB-2018.2038
ESB-2017.2987
Original Bulletin:
https://www.ibm.com/support/docview.wss?uid=ibm10729413
https://www.ibm.com/support/docview.wss?uid=ibm10729419
https://www.ibm.com/support/docview.wss?uid=ibm10729421
https://www.ibm.com/support/docview.wss?uid=ibm10729415
Comment: This bulletin contains four (4) IBM security advisories.
Revision History: August 29 2018: Added additional bulletins
August 28 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: IBM Security Proventia Network Active Bypass is affected by
glibc vulnerabilities (CVE-2011-5320, CVE-2017-15670, CVE-2017-15671,
CVE-2017-15804)
Software version: 3.X
Operating system(s): Windows
Software edition: All Editions
Reference #: 0729413
Modified date: 29 August 2018
Security Bulletin
Summary
IBM Security Proventia Network Active Bypass has addressed the following
vulnerabilities. (CVE-2011-5320, CVE-2017-15670, CVE-2017-15671,
CVE-2017-15804)
Vulnerability Details
CVEID: CVE-2017-15804
DESCRIPTION: GNU C Library (aka glibc or libc6) is vulnerable to a buffer
overflow, caused by improper bounds checking by glob function in glob.c. By
using a specially-crafted file, a local attacker could overflow a buffer.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133996 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVEID: CVE-2017-15671
DESCRIPTION: GNU C Library is vulnerable to a denial of service, caused by a
memory leak in the glob function in glob.c. A remote attacker could exploit
this vulnerability to cause a denial of service condition.
CVSS Base Score: 7.5
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133909 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2017-15670
DESCRIPTION: GNU C Library is vulnerable to a heap-based buffer overflow,
caused by improper bounds checking by the glob function in glob.c. By sending a
specially-crafted string, a remote attacker could overflow a buffer and execute
arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133915 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID: CVE-2011-5320
DESCRIPTION: GNU glibc is vulnerable to a denial of service, caused by a flaw
in the scanf and related functions. By using a large string of os, a local
attacker could exploit this vulnerability to cause a segmentation fault.
CVSS Base Score: 6.2
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/133667 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM Security 1G Network Active Bypass firmware version 1.x through 3.x firmware
levels 1.0.849 through 3.30.10-37
IBM Security 10G Network Active Bypass firmware versions 1.x through 3.x
firmware levels 1.0.1876 through 3.30.10-37
Remediation/Fixes
+----------------------------------------+------+-----------------------------+
|Product |VRMF |Remediation/First Fix |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 1G NAB Update 24 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 10G NAB Update 21 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
For IBM Security Proventia Network Active Bypass products at the following
firmware versions:
o IBM Security 1G Network Active Bypass firmware version 1.X firmware levels
1.0.849 through 3.30.4-12, 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
o IBM Security 10G Network Active Bypass firmware versions 1.X firmware
levels 1.0.1876 through 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
IBM recommends upgrading to 3.30.11, the supported firmware release of the
product.
Workarounds and Mitigations
None
Change History
31 August 2018: Original Version Published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- -------------------------------------------------------------------------------
Security Bulletin: IBM Security Proventia Network Active Bypass is affected by
glibc vulnerabilities (CVE-2018-1000001, CVE-2017-16997, CVE-2017-1000408,
CVE-2017-1000409, CVE-2017-17426)
Software version: 3.X
Operating system(s): Windows
Software edition: All Editions
Reference #: 0729419
Modified date: 29 August 2018
Security Bulletin
Summary
IBM Security Proventia Network Active Bypass has addressed the following
vulnerabilities. (CVE-2018-1000001, CVE-2017-16997, CVE-2017-1000408,
CVE-2017-1000409, CVE-2017-17426)
Vulnerability Details
CVEID: CVE-2017-17426
DESCRIPTION: GNU C Library (aka glibc or libc6) is vulnerable to a heap-based
buffer overflow, caused by an integer overflow in the per-thread cache (aka
tcache) feature. By allocating an object whose size is close to SIZE_MAX, a
remote attacker could overflow a buffer and execute arbitrary code on the
system.
CVSS Base Score: 9.8
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/135985 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2017-1000409
DESCRIPTION: glibc ld.so is vulnerable to a buffer overflow, caused by improper
bounds checking by the _dl_init_paths() in the ld.so. A local attacker could
overflow a buffer and cause the application to crash.
CVSS Base Score: 5.9
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136319 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID: CVE-2017-1000408
DESCRIPTION: glibc is vulnerable to a denial of service, caused by a memory
leak in the ld.so. A local attacker could exploit this vulnerability to cause
the system to crash.
CVSS Base Score: 4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136318 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2017-16997
DESCRIPTION: GNU C Library could allow a local attacker to gain elevated
privileges on the system, caused by a flaw in the elf/dl-load.c. By using a
Trojan horse library, an attacker could exploit this vulnerability to gain
elevated privileges on the system.
CVSS Base Score: 8.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136491 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-1000001
DESCRIPTION: Glibc could allow a local attacker to execute arbitrary code on
the system, caused by a buffer underflow in the __realpath() function in stdlib
/canonicalize.c. An attacker could exploit this vulnerability to execute
arbitrary code on the system and obtain privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/137516 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
IBM Security 1G Network Active Bypass firmware version 1.x through 3.x firmware
levels 1.0.849 through 3.30.10-37
IBM Security 10G Network Active Bypass firmware versions 1.x through 3.x
firmware levels 1.0.1876 through 3.30.10-37
Remediation/Fixes
+----------------------------------------+------+-----------------------------+
|Product |VRMF |Remediation/First Fix |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 1G NAB Update 24 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 10G NAB Update 21 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
For IBM Security Proventia Network Active Bypass products at the following
firmware versions:
o IBM Security 1G Network Active Bypass firmware version 1.X firmware levels
1.0.849 through 3.30.4-12, 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
o IBM Security 10G Network Active Bypass firmware versions 1.X firmware
levels 1.0.1876 through 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
IBM recommends upgrading to 3.30.11, the supported firmware release of the
product.
Workarounds and Mitigations
None
Change History
31 August 2018: Original Version Published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- -------------------------------------------------------------------------------
Security Bulletin: IBM Security Proventia Network Active Bypass is affected by
glibc vulnerabilities (CVE-2018-6485)
Software version: 3.X
Operating system(s): Windows
Software edition: All Editions
Reference #: 0729421
Modified date: 29 August 2018
Security Bulletin
Summary
IBM Security Proventia Network Active Bypass has addressed the following
vulnerabilities. (CVE-2018-6485)
Vulnerability Details
CVEID: CVE-2018-6485
DESCRIPTION: GNU C Library is vulnerable to a denial of service, caused by an
integer overflow in the implementation of the posix_memalign in memalign
functions. A local attacker could exploit this vulnerability to cause the
application to crash.
CVSS Base Score: 4
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/138627 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
IBM Security 1G Network Active Bypass firmware version 1.x through 3.x firmware
levels 1.0.849 through 3.30.10-37
IBM Security 10G Network Active Bypass firmware versions 1.x through 3.x
firmware levels 1.0.1876 through 3.30.10-37
Remediation/Fixes
+----------------------------------------+------+-----------------------------+
|Product |VRMF |Remediation/First Fix |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 1G NAB Update 24 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 10G NAB Update 21 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
For IBM Security Proventia Network Active Bypass products at the following
firmware versions:
o IBM Security 1G Network Active Bypass firmware version 1.X firmware levels
1.0.849 through 3.30.4-12, 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
o IBM Security 10G Network Active Bypass firmware versions 1.X firmware
levels 1.0.1876 through 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
IBM recommends upgrading to 3.30.11, the supported firmware release of the
product.
Workarounds and Mitigations
None
Change History
31 August 2018: Original Version Published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- -------------------------------------------------------------------------------
Security Bulletin: IBM Security Proventia Network Active Bypass is affected by
openssl vulnerabilities (CVE-2017-3738, CVE-2017-3737)
Software version: 3.X
Operating system(s): Windows
Software edition: All Editions
Reference #: 0729415
Modified date: 29 August 2018
Security Bulletin
Summary
IBM Security Proventia Network Active Bypass has addressed the following
vulnerabilities. (CVE-2017-3738, CVE-2017-3737)
Vulnerability Details
CVEID: CVE-2017-3738
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. An attacker could
exploit this vulnerability to obtain information about the private key. Note:
In order to exploit this vulnerability, the server would have to share the
DH1024 private key among multiple clients, which is no longer an option since
CVE-2016-0701.
CVSS Base Score: 3.1
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136078 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2017-3737
DESCRIPTION: An unspecified vulnerability in multiple Oracle products could
allow an unauthenticated attacker to cause low confidentiality impact, low
integrity impact, and high availability impact.
CVSS Base Score: 5.3
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/136077 for the current
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
IBM Security 1G Network Active Bypass firmware version 1.x through 3.x firmware
levels 1.0.849 through 3.30.10-37
IBM Security 10G Network Active Bypass firmware versions 1.x through 3.x
firmware levels 1.0.1876 through 3.30.10-37
Remediation/Fixes
+----------------------------------------+------+-----------------------------+
|Product |VRMF |Remediation/First Fix |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 1G NAB Update 24 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
|IBM Security Proventia Network Active |3.X |Proventia 10G NAB Update 21 |
|Bypass | |(fw 3.30.11) |
+----------------------------------------+------+-----------------------------+
For IBM Security Proventia Network Active Bypass products at the following
firmware versions:
o IBM Security 1G Network Active Bypass firmware version 1.X firmware levels
1.0.849 through 3.30.4-12, 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
o IBM Security 10G Network Active Bypass firmware versions 1.X firmware
levels 1.0.1876 through 3.30.5-21, 3.30.7-23, 3.30.9-27, 3.30.10-37
IBM recommends upgrading to 3.30.11, the supported firmware release of the
product.
Workarounds and Mitigations
None
Change History
31 August 2018: Original Version Published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW4YjvGaOgq3Tt24GAQg2MxAAzUB06zkKjbUQ1Uz8HThwG2dymc0ZORPf
kdvKxEJJAoKgd3lKS2jvpStJp64A98xU1VzNMoUtiu88Pl/4jtIj7afUmPKOMgJr
Jii7pI6peYCrxRmNGo9wjA8Q2LtRSRg6iludgZoduALPRu/4rOojHsqf0vH1DTrS
AdPCqrfgX8+1QdDdDBeSbfSh/E5JEdg6PD8yGa4RpksntDyFllx0Nszz4EsOxWpj
5hx8y7IIWJ4N5mK/4uZVCqP7WpAdg9XWzAlm6NiNlq/pGmy6e4fSOjRSW/eTfKfB
i63Fhwpk8AVMNJaCRRTzHBbil+YTlXovcrOtYmk5d0Epp1LSYLF7MKC80cIw5Tdt
Tlq2UViwfY1UyZDdYLRjf2U35AEhkVCkIPjAeGQHUcdAYaqBC1Sx0Vy9XzJeuRwQ
jzbz0759fCN5n3ljQ0QARMerPQ5sh4Pa/CyymJyvHEWztdPrIuAAEPu9w9G4BEVZ
dXCgi4lXdBGgYP6F9UoTJk78Xr1fIzES26SaNVFoUGZ93b2OLBHCox1aZEVBKCs/
/Kpe+VHAEQPSVjkzB04JliAWSpPzvOBMjMmVP781GKIeX0H6xE+DOVn22xvjZed2
rcmBpw2E6W8SHy3Qiqb4k+oa+EGSEG3x8LLSwUwzr+fRwn5IsNHwI4QLaeaPJL/9
TsA6tPQklCA=
=0BHz
-----END PGP SIGNATURE-----