IBM QRadar SIEM: Access Privileged Data -- Existing Account

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.1971
           OpenSSL as used in IBM QRadar SIEM is vulnerable to a
                  information disclosure (CVE-2018-5407)
                                3 June 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM QRadar SIEM
Publisher:         IBM
Operating System:  Linux variants
Impact/Access:     Access Privileged Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-5407  

Reference:         ASB-2019.0060
                   ASB-2018.0311
                   ESB-2019.1963
                   ESB-2019.1789

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=ibm10886313

- --------------------------BEGIN INCLUDED TEXT--------------------

OpenSSL as used in IBM QRadar SIEM is vulnerable to a information disclosure
(CVE-2018-5407)

Product:             IBM QRadar SIEM
Software version:    7.3
Operating system(s): Linux
Software edition:    All Editions
Reference #:         0886313

Security Bulletin

Summary

Open Source OpenSSL is vulnerable to a publicly disclosed vulnerability

Vulnerability Details

CVEID: CVE-2018-5407
Description: Multiple SMT/Hyper-Threading architectures and processors could
allow a local attacker to obtain sensitive information, caused by execution
engine sharing on Simultaneous Multithreading (SMT) architecture. By using the
PortSmash new side-channel attack, an attacker could run a malicious process
next to legitimate processes using the architectures parallel thread running
capabilities to leak encrypted data from the CPU's internal processes. Note:
This vulnerability is known as PortSmash.
CVSS Base Score: 5.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
152484 for the current score
CVSS Environmental Score: *Undefined
CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products and Versions

IBM QRadar SIEM 7.3.0 - 7.3.2 Patch 1

Remediation/Fixes

QRadar / QRM / QVM / QRIF / QNI 7.3.2 Patch2

Workarounds and Mitigations

None

Change History

May 31st, 2019: First Publish

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXPR50maOgq3Tt24GAQjdMRAAuhGu8UPdQXNTVrmz6+3ho7h6vh8rPQmA
LtOL07YnCz7qOZj2wm9WSYTO7wc5Nu+KzkFug20pzghPmR3Q+x2270Iy4JwkmsKn
GDG3NSQ+FufB0fmtgSi1nX6ClD9mHhM872x7ct7VGx2Uc/h63bucl3TAERuj+wFz
X6OWhsXzq9cSt5vRo+vKyiNNoMOBOGsXQyVN7tN6/DIyYJUg7BFsP3eH98e5Taby
9i1mYXSR+krzCcznFGUQ02JYYF0pGqXH/ev12/o41hLMOib13W6pa57v/jswD6iV
pvfMRKphCj2EWFAjmYTl57tfxl4aPytdq3pFtHk+UscWZdF2YtHYgdO2vY/YTB42
0wFDR9sjIIFYQYaMdzPhu/SMSQ66vZaQJsgwB9m4j5QHbRWSGwD10qjnM+h5q0yy
J8U0iRSHt2TLmDx62jIUDSPEKpRCXF1eO6OiDw8ZPnyV3/BRq3h3SxBCcMdx7P4n
XWBDHEDs/DFtKmaoE1i3M5EFV5tO8nw2Z58vzu/Med3s7uHGkBX2zyJIgvmPxivz
etKeaYLo1AGJenudAZURrjw7FMHomqRfsq3wyWVLfBsdt7OfFghPdzuRQ9T7w1pI
lU+OgnXx9uNJIxEWgpqsKWeWqy8jA8mJxNRN2zyrYEe3m9nxqXDK/Yb7YQATMJiz
4MuXaImHaTc=
=51Tq
-----END PGP SIGNATURE-----