The IBM Verify Gateway (IVG) Authd service listens on TCP port 12. It’s possible to mount a denial of service attack by sending malformed requests to port 12, thereby crashing the service. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the Authd service is not used. The PAM module now goes directly to the tenant using TLS encryption.
CVEID:CVE-2020-4399
**DESCRIPTION:**IBM Verify Gateway (IVG) could allow an authenticated user to send malformed requests to cause a denial of service against the server.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179476 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Verify Gateway (IVG) | PAM 1.0.0, 1.0.1 |
Log in to IBM X-Force Exchange / App Exchange and download and install the latest IBM Security Verify Gateway (renamed from IBM Verify Gateway) PAM components. Specifically:
None