IBM6BF8F8C90E715B9A143845523172F62A58B1115933F9F9D53ECEE1B15908CAA2Security Bulletin: IBM b-type SAN switches and directors affected by Open Source OpenSSL Vulnerabilities (CVE-2016-2180).
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
96.4%
Summary
IBM b-type SAN switches and directors has addressed Open Source OpenSSL Vulnerabilities.
Vulnerability Details
CVEID:CVE-2016-2180**
DESCRIPTION: *OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read in the TS_OBJ_print_bio function. A remote attacker could exploit this vulnerability using a specially crafted time-stamp file to cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/115829 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
FOS 7.X versions prior to 7.4.2
FOS 8.X versions prior to 8.1.0c
IBM Network Advisor versions prior to 14.0.2
Remediation/Fixes
Product
| VRMF| Fix
—|—|—
FOS| 7.4.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S1003855__
_FOS _| 8.1.0c| _http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009577_
IBM Network Advisor| 14.0.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S7005391__
Workarounds and Mitigations
None
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | storage_protect | any | cpe:2.3:a:ibm:storage_protect:any:*:*:*:*:*:*:* |
| ibm | scale_out_network_attached_storage | any | cpe:2.3:h:ibm:scale_out_network_attached_storage:any:*:*:*:*:*:*:* |
| ibm | ibm_san24b_series_switches_6.2.2g | any | cpe:2.3:a:ibm:ibm_san24b_series_switches_6.2.2g:any:*:*:*:*:*:*:* |
| ibm | san384b_fabric_backbone_\(2499-192\) | any | cpe:2.3:a:ibm:san384b_fabric_backbone_\(2499-192\):any:*:*:*:*:*:*:* |
| ibm | san06b-r_\(2498-r06\) | any | cpe:2.3:a:ibm:san06b-r_\(2498-r06\):any:*:*:*:*:*:*:* |
| ibm | san64b-6_switch_\(8960-f64-n64\) | any | cpe:2.3:a:ibm:san64b-6_switch_\(8960-f64-n64\):any:*:*:*:*:*:*:* |
| ibm | san768b_fabric_backbone_\(2499-384\) | any | cpe:2.3:a:ibm:san768b_fabric_backbone_\(2499-384\):any:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
96.4%