Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2058
IBM API Connect's Developer Portal is impacted by
vulnerabilities in PHP (CVE-2019-11035 CVE-2019-11034)
10 June 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM API Connect Developer Portal
Publisher: IBM
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-11035 CVE-2019-11034
Reference: ESB-2019.1920
ESB-2019.1912
ESB-2019.1873
ESB-2019.1855
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10882572
- --------------------------BEGIN INCLUDED TEXT--------------------
IBM API Connect's Developer Portal is impacted by vulnerabilities in PHP
(CVE-2019-11035 CVE-2019-11034)
Product: IBM API Connect
Component: Developer Portal
Software version: 5.0.0.0-5.0.8.6, 2018.1-2018.4.1.4
Operating system(s): Platform Independent
Reference #: 0882572
Security Bulletin
Summary
IBM API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID: CVE-2019-11034
DESCRIPTION: PHP could allow a remote attacker to obtain sensitive information,
caused by heap-based buffer overflow in the exif_process_IFD_TAG function in
the EXIF extension. By persuading a victim to open a specially-crafted file, an
attacker could exploit this vulnerability to obtain sensitive information or
cause a denial of service condition.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
159895 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVEID: CVE-2019-11035
DESCRIPTION: PHP could allow a remote attacker to obtain sensitive information,
caused by heap-based buffer overflow in the exif_iif_add_value function in the
EXIF extension. By persuading a victim to open a specially-crafted file, an
attacker could exploit this vulnerability to obtain sensitive information or
cause a denial of service condition.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/
159896 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Affected Products and Versions
+---------------+------------------+
|IBM API Connect|v2018.1-2018.4.1.4|
+---------------+------------------+
|IBM API Connect|v5.0.0.0-5.0.8.6 |
+---------------+------------------+
Remediation/Fixes
+------------------+-------------+-------+---------------------------------------------------------------------------------------------------+
|Affected Product |Addressed in |APAR |Remediation/First Fix |
| |VRMF | | |
+------------------+-------------+-------+---------------------------------------------------------------------------------------------------+
| | | |Addressed in IBM API Connect v2018.4.1.5fixpack. |
| | | | |
| | | |Developer Portal is impacted. |
| | | | |
|IBM API Connect |2018.4.1.5 |LI80821|Follow this link and find the "portal" package appropriate for the form factor |
|V2018.1-2018.4.1.4|fixpack | |of your installation: |
| | | | |
| | | |http://www.ibm.com/support/fixcentral/swg/quickorderparent=ibm%7EWebSphere& |
| | | |product=ibm/WebSphere/IBM+API+Connect&release=2018.4.1.4&platform=All&function= |
| | | |all&source=fc |
+------------------+-------------+-------+---------------------------------------------------------------------------------------------------+
| | | |Addressed in IBM API Connect 5.0.8.6iFix. |
| | | | |
| | | |Developer Portal is impacted. |
| | | | |
|IBM API Connect | | |Follow this link and find the " APIConnect-Portal " package appropriate for the |
|V5.0.0.0-5.0.8.6 |5.0.8.6 iFix |LI80821|form factor of your installation: |
| | | | |
| | | | |
| | | |http://www.ibm.com/support/fixcentral/swg/quickorderparent=ibm%7EWebSphere& |
| | | |product=ibm/WebSphere/IBM+API+Connect&release=5.0.8.6&platform=All&function=all |
| | | |&source=fc |
+------------------+-------------+-------+---------------------------------------------------------------------------------------------------+
Workarounds and Mitigations
None
Change History
May 22, 2019: Original bulletin published
Product Alias/Synonym
APIC
API Connect
Developer Portal
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXP2bGmaOgq3Tt24GAQiqHxAAhmIu+HH1mmNyPNTjD2OnDx9P0lhBhpeE
fsmDkp9s/HbVUDD1jRjHoYP0eeca0rCAIOMy0R+80UWKRRxT6ZpCk3U1rh8kPzSS
IPTJIT+bcdUyc1YCYj6aUdtlLKppgogPpUwkKfJk1mkXzUCapL5U7vwuEm6s92Ru
lgzpyfLd+vzEET6LpMLRMQno9+EelH9kLNlkEjujMW3rpdvSVkifJy016++Np3+A
s0QpXkjqON3sWB0Vg0JnTyMOnIhurjKPSwO2PB7osXPYlgtU0xwSKRGMoe66TQHV
1o5yPasDeFfv84SoRrEcPEzgabX6ZBzqJi4KZ4dQ5Sk8yskw30RzCc+jXmVwEQ4Q
fZLGMEtA1FV7T7BFVBs1IMXw7aLhL75yGQpxNQ9eRnogJfjWWOcrc2Fl/+tBDxAW
cSLCYnxryz0CbxglqMU0ktfpj5ap1iMtHoZ5nDd1axiBKtferWHz/yIWyPuqF9WS
I/nbCSGUxlVQu3boYkoQB4vZ63VTkc+uh6FPCcMETyGVyCSJ3o1zFKAlezMeISmR
4QeSTT5osb4jjYCMzEB+fHu+BT/pIMSGemWMNAEYfsKsUetRPvIZOJ8KbAUu1vYV
PgakMIThR27u1FjwyTzmYnpxc7AuxRuv6cvp/FxYs5LlGxy9DPcK0vtKzyeVXw9d
knwbEbGGH1E=
=7BFt
-----END PGP SIGNATURE-----