Security Bulletin: Vulnerabilities in the GNU C Libraries (glibc) affect IBM Flex System Manager(FSM) (CVE-2013-2207, CVE-2014-8121, CVE-2015-1781)

Summary

Multiple security vulnerabilities have been discovered in the GNU C Library (glibc) that is embedded in the IBM FSM. These vulnerabilities are addressed in this bulletin.

Vulnerability Details

CVEID: CVE-2013-2207**
DESCRIPTION:** The GNU C Library (glibc) could allow a local attacker to bypass security restrictions, caused by an error in the pt_chown() function. An attacker could exploit this vulnerability to gain unauthorized access to the pseudoterminal of other users.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/86914 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-8121**
DESCRIPTION:** GNU C Library (glibc) is vulnerable to a denial of service, caused by the failure to properly check if a file is open by DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS). By performing a look-up on a database while iterating over it, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102652 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-1781**
DESCRIPTION:** GNU C Library (glibc) is vulnerable to a buffer overflow, caused by improper bounds checking by the gethostbyname_r() and other related functions. By sending a specially-crafted argument, a remote attacker could overflow a buffer and execute arbitrary code on the system elevated privileges or cause the application to crash.
CVSS Base Score: 5.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102500 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Flex System Manager 1.3.4.x
Flex System Manager 1.3.3.x
Flex System Manager 1.3.2.x
Flex System Manager 1.3.1.x
Flex System Manager 1.3.0.x
Flex System Manager 1.2.x.x
Flex System Manager 1.1.x.x

Remediation/Fixes

IBM recommends updating the FSM using the instructions referenced in this table.

Warning: Agents older than version 6.3.5 must be updated using the Technote listed in these Remediation plans before this FSM fix is installed or you will permanently lose contact with the endpoint with agents older than version 6.3.5

Product |

VRMF |

APAR |

Remediation
—|—|—|—
Flex System Manager|

1.3.4.x |

IT12599

| Verify the required Java updates have been completed, then install fsmfix1.3.4.0_IT11636_IT12081_IT12596_IT12597_IT12599_IT12601_IT12602

Instructions for verifying installation of the Java updates can be found in the “Confirm the fixes were applied properly” section of Technote 761981453.

Flex System Manager|

1.3.3.x |

IT12599

| Verify the required Java updates have been completed, then install fsmfix1.3.3.0_IT11636_IT12081_IT12596_IT12597_IT12599_IT12601_IT12602

Instructions for verifying installation of the Java updates can be found in the “Confirm the fixes were applied properly” section of Technote 736218441.

Flex System Manager|

1.3.2.x |

IT12599

| Verify the required Java updates have been completed, then install fsmfix1.3.2.0_IT11636_IT12081_IT12596_IT12597_IT12599_IT12601_IT12602

Instructions for verifying installation of the Java updates can be found in the “Confirm the fixes were applied properly” section of Technote 736218441.

Flex System Manager|

1.3.1.x |

IT12599

| IBM recommends upgrading to a fixed, supported version/release and following the appropriate remediation for all vulnerabilities.
Flex System Manager|

1.3.0.x |

IT12599

| IBM recommends upgrading to a fixed, supported version/release and following the appropriate remediation for all vulnerabilities.
Flex System Manager|

1.2.x.x |

IT12599

| IBM recommends upgrading to a fixed, supported version/release and following the appropriate remediation for all vulnerabilities.
Flex System Manager|

1.1.x.x |

IT12599 | IBM recommends upgrading to a fixed, supported version/release and following the appropriate remediation for all vulnerabilities.

Workarounds and Mitigations

None