Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0644.2
Security Bulletin: Multiple Vulnerabilities Affects IBM
Sterling B2B Integrator
24 April 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Sterling B2B Integrator
Publisher: IBM
Operating System: AIX
HP-UX
Linux variants
Solaris
Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Cross-site Scripting -- Existing Account
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-4042 CVE-2019-4029 CVE-2019-4028
CVE-2019-4027 CVE-2018-5407 CVE-2018-0734
Reference: ASB-2019.0033
ASB-2019.0021
ASB-2018.0311
ESB-2019.0481
ESB-2019.0473
ESB-2019.0374
ESB-2019.0169.4
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10874240
http://www.ibm.com/support/docview.wss?uid=ibm10874244
http://www.ibm.com/support/docview.wss?uid=ibm10874246
http://www.ibm.com/support/docview.wss?uid=ibm10793579
Comment: This bulletin contains four (4) IBM security advisories.
Revision History: April 24 2019: Additional IBM bulletin released
March 1 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: Permission Control Security Vulnerability Affects IBM
Sterling B2B Integrator (CVE-2019-4042)
Document information
More support for: Sterling B2B Integrator
Software version: 5.2.0.1 - 6.0.0.0
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Reference #: 0874240
Modified date: 28 February 2019
Summary
IBM Sterling B2B Integrator Standard Edition has addressed the permission
control vulnerability.
Vulnerability Details
CVEID: CVE-2019-4042
DESCRIPTION: IBM Sterling B2B Integrator could allow a user without permission
to access EBICS configuration to use its own secure token to access the
configuration.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities
/156238 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected Products and Versions
IBM Sterling B2B Integrator 5.2.0.1 - 6.0.0.0
Remediation/Fixes
+-----------------+----------------------------+-----------------------------+
|PRODUCT & Version|APAR |Remediation/Fix |
+-----------------+----------------------------+-----------------------------+
|IBM Sterling B2B |IT27906 |Apply IBM Sterling B2B |
|Integrator | |Integrator version 5.2.6.3_9 |
|5.2.0.1 - 6.0.0.0| |or 6.0.0.1 available on Fix |
| | |Central |
+-----------------+----------------------------+-----------------------------+
Workarounds and Mitigations
No
Change History
28 February 2019: Original version published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
==============================================================================
ecurity Bulletin: Multiple Security Vulnerabilities in OpenSSL Affect IBM
Sterling B2B Integrator (CVE-2018-0734, CVE-2018-5407)
Document information
More support for: Sterling B2B Integrator
Software version: 5.2.0.0 - 6.0.0.0
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Reference #: 0874244
Modified date: 28 February 2019
Summary
Security vulnerabilities in OpenSSL affect IBM Sterling B2B Integrator
Vulnerability Details
CVE-ID: CVE-2018-0734
Description: OpenSSL could allow a remote attacker to obtain sensitive
information, caused by a timing side channel attack in the DSA signature
algorithm. An attacker could exploit this vulnerability using variations in
the signing algorithm to recover the private key.
CVSS Base Score: 3.7
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/
152085 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-5407
DESCRIPTION: Multiple SMT/Hyper-Threading architectures and processors could
allow a local attacker to obtain sensitive information, caused by execution
engine sharing on Simultaneous Multithreading (SMT) architecture. By using the
PortSmash new side-channel attack, an attacker could run a malicious process
next to legitimate processes using the architectures parallel thread running
capabilities to leak encrypted data from the CPU's internal processes. Note:
This vulnerability is known as PortSmash.
CVSS Base Score: 5.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities
/152484 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
IBM Sterling B2B Integrator 5.2.0.1 - 6.0.0.0
Remediation/Fixes
+----------------------------+-----------------------------------------------+
|PRODUCT & Version |Remediation/Fix |
+----------------------------+-----------------------------------------------+
|IBM Sterling B2B Integrator |SWIFTNet Customers must upgrade their B2B |
|5.2.0.1 - 6.0.0.0 |Integrator at least to 5020603_2, 5020602_4 , |
| |5020601_7 or 6.0.0.0 available on Fix Central |
| |and current version of OpenSSL to version |
| |1.0.2q |
+----------------------------+-----------------------------------------------+
Workarounds and Mitigations
No
Change History
28 February 2019: Original version published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
==============================================================================
Security Bulletin: Multiple Cross-Site Scripting Vulnerabilities Affect IBM
Sterling B2B Integrator (CVE-2019-4027, CVE-2019-4028, CVE-2019-4029)
Document information
More support for: Sterling B2B Integrator
Software version: 5.2.0.1 - 6.0.0.0
Operating system(s): AIX, HP-UX, Linux, Solaris, Windows
Reference #: 0874246
Modified date: 28 February 2019
Summary
IBM Sterling B2B Integrator Standard Edition has addressed the cross-scripting
vulnerabilities
Vulnerability Details
CVEID: CVE-2019-4029
DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to
cross-site scripting. This vulnerability allows users to embed arbitrary
JavaScript code in the Web UI thus altering the intended functionality
potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities
/155907 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVEID: CVE-2019-4027
DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to
cross-site scripting. This vulnerability allows users to embed arbitrary
JavaScript code in the Web UI thus altering the intended functionality
potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities
/155905 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVEID: CVE-2019-4028
DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to
cross-site scripting. This vulnerability allows users to embed arbitrary
JavaScript code in the Web UI thus altering the intended functionality
potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities
/155906 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
IBM Sterling B2B Integrator 5.2.0.1 - 6.0.0.0
Remediation/Fixes
+-----------------+----------------------------+-----------------------------+
|PRODUCT & Version|APAR |Remediation/Fix |
+-----------------+----------------------------+-----------------------------+
|IBM Sterling B2B |IT27458, IT27878, IT27461, |For CVE-2019-4029, apply IBM |
|Integrator |IT27881 |Sterling B2B Integrator |
|5.2.0.1 - 6.0.0.0| |version 5.2.6.3_9 or |
| | |6.0.0.1 available on Fix |
| | |Central For others, apply |
| | |6.0.0.1 |
+-----------------+----------------------------+-----------------------------+
Workarounds and Mitigations
No
Change History
28 February 2019: Original version published
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
==============================================================================
Multiple vulnerabilities in OpenSSL affect IBM Sterling Connect:Express for
UNIX (CVE-2018-0734 and CVE-2018-5407)
Product: Sterling Connect:Express for UNIX
Software version: 1.5.0
Operating system(s): AIX, Linux, Solaris
Reference #: 0793579
Security Bulletin
Summary
OpenSSL vulnerabilities were disclosed on October 30, 2018 (CVE-2018-0734) and
November 02, 2018 (CVE-2018-5407) by the OpenSSL Project. OpenSSL is used by
Sterling Connect:Express for UNIX. Sterling Connect:Express for UNIX has
addressed the applicable CVEs.
Vulnerability Details
CVEID: CVE-2018-0734
DESCRIPTION: The OpenSSL DSA signature algorithm has been shown to be
vulnerable to a timing side channel attack. An attacker could use variations in
the signing algorithm to recover the private key. Reported by Samuel Weiser.
At the time of publishing this security bulletin the vulnerability score is
still undergoing analysis. Visit https://nvd.nist.gov/vuln/detail/CVE-2018-0734
for an updated status.
CVSS v3.0 Base Score: 5.1
CVSS v3.0 Temporal Score: See https://exchange.xforce.ibmcloud.com/
vulnerabilities/152085 for the current score
CVSS v3.0 Environmental Score*: Undefined
CVSS v3.0 Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVEID: CVE-2018-5407
DESCRIPTION: OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH,
has been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing attacks during
ECDSA signature generation could recover the private key. Reported by Alejandro
Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and
Nicola Tuveri.
CVSS v3.0 Base Score: 4.7
CVSS v3.0 Temporal Score: See https://exchange.xforce.ibmcloud.com/
vulnerabilities/152484 for the current score
CVSS v3.0 Environmental Score*: Undefined
CVSS v3.0 Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products and Versions
IBM Sterling Connect:Express for UNIX 1.5.0.15
All versions prior to and including 1.5.0.15 iFix 150-1509
Remediation/Fixes
Apply the OpenSSL1.0.2q updater for Connect:Express for Unix available on Fix
Central .
Workarounds and Mitigations
No workaround, applying the fix is the recommended mitigation.
Change History
24 January 2019: Original document published
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXL+4cWaOgq3Tt24GAQil5w//dw/Sxyj2GPPvkoqha/LxMOSVoe70cuva
aeVi/h4jkPr+y2ESHnCJbyJLmColzWBh6K2AcgoZPNsMnbcWDNAtyRTu1y0W531s
RIbdcxrhBZJeGMse/URvRAMViDtZ2sf9oF0Xox+IeGNiVVXenev0GRd1zXEvqbWS
bBpbJnxfQUol7UjsgewISA5Claf3QY5ubv54U5hdqN2yrzeQ6bjN44+BX0M0dwh8
9D+aScA+E+ssUAj+BfrAaZB8WBsHF04gdDHFd7SDFslFtp2+mafcrcjwNMrM8aNg
5tMLQnlwwi5ZeDlFiUF++uPJdd5L+2hO8Yj1uHYTBlS83SV0rpDsScGgMWBWW+qO
4YsdBxfw6Qan0raRT93uylABf35BjNyK9naOWRCX7NqYUFvTcNkitF4vemn0Uv2a
1OVSiDikuffrGSCT22CqM6XBUGXtSbAR6ziF/s+K29LSjDi+CplXEGgA3YM1YnU8
jASt1YjCNdw/W1Jbnh54uveIQgnlNSiVgcLbUV+5ic4oM1A5YA99phMQ48lU75zu
KCQ3jodyn/bpRtsWyRF37LrkxcRA+wSeaSrbcregtYa+7jntzRlazw3oBYc638u5
GsB7TdteymF3TGITUf4CqLrhGyoPVJV0jDKtLhQ7X5giQYzII6+0ksTh+zyQ/jkO
rbA4sGfmiZM=
=mBmL
-----END PGP SIGNATURE-----