Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0468
IBM PureApplication Service is affected by a GPFS vulnerability
14 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: PureApplication System
Publisher: IBM
Operating System: Windows
AIX
Linux variants
Impact/Access: Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1783
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10795195
http://www.ibm.com/support/docview.wss?uid=ibm10795189
Comment: This bulletin contains two (2) advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
IBM PureApplication Service is affected by a GPFS vulnerability (CVE-2018-1783)
Product: PureApplication Service
Component: Security
Software version: 2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.2,
2.2.5.3
Operating system(s): Windows
Software edition: All Editions
Reference #: 0795195
Summary
There is a vulnerability in the GPFS component that is used by IBM
PureApplication Service. IBM has released Version 2.2.5.3 for IBM
PureApplication Service, in response to CVE-2018-1783. IBM PureApplication
Service provides a GPFS pattern and addressed the applicable CVE.
Vulnerability Details
CVEID: CVE-2018-1783
DESCRIPTION: IBM GPFS command line utility allows an unprivileged,
authenticated user with access to a GPFS node to forcefully terminate GPFS and
deny access to data available through GPFS.
CVSS Base Score: 6.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
148806 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM PureApplication Service V2.2.3.0
IBM PureApplication Service V2.2.3.1
IBM PureApplication Service V2.2.3.2
IBM PureApplication Service V2.2.4.0
IBM PureApplication Service V2.2.5.0
IBM PureApplication Service V2.2.5.2
Remediation/Fixes
For Intel:
Upgrade IBM PureApplication Service to the following fix pack release:
- - V2.2.5.3
Contact IBM for assistance.
Information on upgrading can be found here: http://www-01.ibm.com/support/
docview.wssuid=swg27039159
Workarounds and Mitigations
None
Change History
February 13, 2019: Original document published
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------------------------------------------------------------
Subject: New IBM bulletin: IBM Security Bulletin: IBM PureApplication System is affected by a GPFS vulnerability (CVE-2018-1783)
From: ibm-bulletins@auslegacy.compute.dc.uq.edu.au
Date: Thu, 14 Feb 2019 05:51:45 +1000
To: auto-bulletins@auscert.org.au
IBM PureApplication System is affected by a GPFS vulnerability (CVE-2018-1783)
Product: PureApplication System
Component: Security
Software version: 2.2.3.0, 2.2.3.1, 2.2.3.2, 2.2.4.0, 2.2.5.0, 2.2.5.1,
2.2.5.2, 2.2.5.3
Operating system(s): AIX, Linux, Windows
Software edition: All Editions
Reference #: 0795189
Summary
There is a vulnerability in the GPFS component that is used by IBM
PureApplication System. IBM has released Version 2.2.5.3 for IBM
PureApplication System, in response to CVE-2018-1783. IBM PureApplication
System provides a GPFS pattern and addressed the applicable CVE.
Vulnerability Details
CVEID: CVE-2018-1783
DESCRIPTION: IBM GPFS command line utility allows an unprivileged,
authenticated user with access to a GPFS node to forcefully terminate GPFS and
deny access to data available through GPFS.
CVSS Base Score: 6.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
148806 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM PureApplication System V2.2.3.0
IBM PureApplication System V2.2.3.1
IBM PureApplication System V2.2.3.2
IBM PureApplication System V2.2.4.0
IBM PureApplication System V2.2.5.0
IBM PureApplication System V2.2.5.1
IBM PureApplication System V2.2.5.2
Remediation/Fixes
For Intel:
Upgrade IBM PureApplication System to the following fix pack release:
- - V2.2.5.3
For AIX:
Upgrade IBM PureApplication System to the following fix pack release:
- - V2.2.5.3
Contact IBM for assistance.
Information on upgrading can be found here: http://www-01.ibm.com/support/
docview.wssuid=swg27039159
Workarounds and Mitigations
None
February 13, 2019: Original document published
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXGTDTWaOgq3Tt24GAQgXihAAzk9yqr9labq2mX/R0pIGDefvFwJQpZ+J
g2JZ/NKIlRjvKuKvB9elH/ihtRp4TNJZiYzkoz3KO1qhOCpYDXRlPgfIMQwFNJdw
ALx7u2KjVI5sY38MaKStxzrltqlI+dFcqcS5LedPH8ubn5pBUsEO2Y0UqQZi3o8K
49L4j8fx7CDsi238oXjtG95mJNJgCokI8/qx4et6HRZoLK7jUKT2geTFaFZtseNt
CtYoRFV8Exs+odFdK1kd90e8ea8iJJ2oVluLqsA0zZmcY7Zp7mZzN+hlj2wK6f3m
NNjzfbInB4zpgIi28riZEBVjeXHrx1Yf4O7R0xW2SC7EGUGYyL2fEIZx3FkHsNP6
KSFlLBn0z81FxQgWjPzoY8HfzFNjRJwOcqzozFgS3sl7bN6vALP4u67J1LFzTpHY
oSumsckqSHw+F6gs94MLv8mpaOGD11ZtJEmvHt2ViUCg0tmHURq1oOkcNqisx1UU
Gq/CQ3AzWjY1UkHPqGiwfNSZQReLY52FGH50NkfEL7ss4Z6J1/NoIeBEsNGLYdUy
O1zluKG+KuUiLlrmtaA8gR7EKqRHrZISwz/ao/i677wz5yptdOsm070hOPzRHlXW
QP3k+iOgA/DC7WSgekkT6Wu/TZTzwgqAknWgIoKtvUoQLPCe+gYd3mVdMSTt8FgU
mpg2hsjBOdw=
=oSFA
-----END PGP SIGNATURE-----