IBM QRadar Network Packet Capture Software: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.3353
 Security Bulletin: Node.js as used by IBM Security QRadar Packet Capture
             contains multiple vulnerabilities (CVE-2020-8201,
               CVE-2020-8252, CVE-2020-8251, CVE-2020-8277)
                              8 October 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM QRadar Network Packet Capture Software
Publisher:         IBM
Operating System:  Linux variants
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Cross-site Scripting            -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Reduced Security                -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-8277 CVE-2020-8252 CVE-2020-8251
                   CVE-2020-8201  

Reference:         ESB-2021.0587
                   ESB-2020.4214

Original Bulletin: 
   https://www.ibm.com/support/pages/node/6497219

- --------------------------BEGIN INCLUDED TEXT--------------------

Node.js as used by IBM Security QRadar Packet Capture contains multiple
vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251, CVE-2020-8277)

Document Information

Document number    : 6497219
Modified date      : 07 October 2021
Product            : IBM QRadar Network Packet Capture Software
Software version   : 7.3, 7.4
Operating system(s): Linux

Summary

Node.js as used by IBM Security QRadar Packet Capture contains multiple
vulnerabilities.

Vulnerability Details

CVEID: CVE-2020-8201
DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by
CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an
attacker could exploit this vulnerability to poison the web cache, bypass web
application firewall protection, and conduct XSS attacks.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
188591 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2020-8252
DESCRIPTION: Node.js is vulnerable to a buffer overflow, caused by improper
bounds checking by the libuv's fs.realpath.native. By sending an overly long
argument, a remote attacker could overflow a buffer and execute arbitrary code
on the system or cause a denial of service.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
188593 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2020-8251
DESCRIPTION: Node.js is vulnerable to a denial of service, caused by delayed
unfinished HTTP/1.1 requests submission. An attacker could exploit this
vulnerability to make the server unable to accept new connections and exhaust
all available resources.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
188592 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2020-8277
DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the
application to resolve a DNS record with a larger number of responses, an
attacker could exploit this vulnerability to trigger a DNS request for a host
of their choice resulting in a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
191755 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Fix Pack 7

IBM QRadar Network Packet Capture 7.4.0 - 7.4.3 Fix Pack 1

Remediation/Fixes

IBM QRadar Network Packet Capture 7.3.3 Patch 8

IBM QRadar Network Packet Capture 7.4.3 Patch 2

Workarounds and Mitigations

None

Change History

07 Oct 2021: Initial Publication

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYV/aFONLKJtyKPYoAQg9gxAAijY4EkX9PuaR3OvIlZo+5gMX3K/k806/
iKpxmW7xteRIw88MEgXTX/+ShxmnTaNDUKrjqaxrQFvHNOq1Pc8KtEjDZ27vc8GO
EMnuKtZBHafI2bW42y3E5wu5Gm/85EPyekpW7yPzbJ/Ge+nnNzpuOq0hkgLV50B4
aIDdi7DzwtgRwJj4X1OjGup+HhksxEyr9/ARgjcj+uhI0LBNEOSkcZq20ze0iqCY
UKmv7vJG6akq6Qij24DMctBiHosTdp7bMVKJHfKEdIcLnj4qwyw/k+LQV6uyC8Gf
Xg2rDrER/BG4C49Rot2m1bKh9Izuby9k6x5ystl1oTMIGe3++T9m7nkyDjRJYBZY
VLYjB6wIXmoIqrq3mQHuKcYuFXeMCwmstjaYT1rnOhvNIKp1wm1gjTk5XgGH5shH
Xsusk3gjKOwuPKbT7QEbDHjsiLAgWeIjSVjZ/MkoRF2fhtakok8p2RZ+oogXiVCS
u8gxbKZvSCVwmJ5W7c8QQZedESGT87/IlIXku8IbWE46Cr9FAk9p+bGqqwPDeP3H
RbF4WUNxrGdQqcLIXH73eFc48yafAmD5+ox/iFZ13nWBtzFFJ8P/UFauYthAB5jz
UN9Pl3eqsp184N1yyISFBU56DE0l/JNOr+kB0eUbF5HQMAqI1I0bdulcrpM/NAxa
/ufuD32Fn38=
=lIcE
-----END PGP SIGNATURE-----