A security vulnerability was discovered in PAM that is embedded in the IBM FSM. This bulletin addresses this vulnerabilities.
CVEID: CVE-2013-7041**
DESCRIPTION:** pam_userdb module for Pam could provide weaker than expected security, caused by an error in the strncasecmp() function within the pam_userdb module for Pam on comparison of the stored hash password with the user’s password hash. An attacker could exploit this vulnerability using brute-force techniques to obtain user credentials.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89588 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Flex System Manager 1.3.4.x
Flex System Manager 1.3.3.x
Flex System Manager 1.3.2.x
IBM recommends updating the FSM using the instructions referenced in this table.
Product |
VRMF |
APAR |
Remediation
—|—|—|—
Flex System Manager|
1.3.4.x |
IT16776
| Ensure the steps in Technote 761981453 are completed, and then install
fsmfix1.3.4.0_IT16772_IT16773_IT16774_IT16776
Flex System Manager|
1.3.3.x |
IT16776
| Ensure the steps in Technote 736218441 are completed and then install
fsmfix1.3.3.0_IT16772_IT16773_IT16774_IT16776
Flex System Manager|
1.3.2.x |
IT16776
| Ensure the steps in Technote 736218441 are completed and then install
fsmfix1.3.2.0_IT16772_IT16773_IT16774_IT16776
For 1.1.x.x, 1.2.x.x, 1.3.0.x and 1.3.1.x IBM recommends upgrading to a fixed, supported version/release of the product.
You should verify applying this fix does not cause any compatibility issues. The fix disables older encrypted protocols by default. If you change the default setting after applying the fix, you will expose yourself to the attack described in IT15244. IBM recommends that you review your entire environment to identify other areas where you have enabled weak encryption and take appropriate mitigation and remediation actions.
none