CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS
Percentile
93.0%
IBM Director Systems, specifically CIM Server, contains a denial-of-service vulnerability that can allow a remote, unauthenticated attacker to render Director inoperative.
IBM Director is a suite of system management tools.
When a rogue connection request is made to IBM Director Systems, specifically the CIM Server, a thread is created that listens on a port, waiting for a specific response from the client. If the client does not send the expected response, the thread remains in memory listening, indicating a high CPU utilization until the client connects to it. If multiple rogue clients connect simultaneously, the finite number of connections can be exhausted causing server to crash.
Versions 5.20.1 and earlier for Windows and Linux are affected.
IBM Director Systems will become inaccessible for management.
Apply an update
Download and Apply the patch for Windows and Linux systems here:
<https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dmp>
Block or restrict access
Employ other protection mechanisms that will restrict access to the Director Systems by installing firewalls, defining filters, or by using reverse proxies.
512193
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: November 15, 2007 Updated: November 20, 2007
Affected
Download and Apply patch for Windows and Linux from here
<https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dmp>
The vendor has not provided us with any further information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to IBM for reporting this vulnerability, who in turn credit Juniper Networks.
This document was written by Will Dormann.
CVE IDs: | CVE-2007-5612 |
---|---|
Severity Metric: | 0.91 Date Public: |