IBM Security Network Protection uses Kerberos (krb5) to provide network authentication. The Kerberos (krb5) version that is shipped with IBM Security Network Protection contains multiple security vulnerabilities.
CVE-ID: CVE-2014-5352 Description: MIT krb5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a double-free error in gss_process_context_token(). An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.0
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100842> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-ID: CVE-2014-5353 Description: MIT krb5 is vulnerable to a denial of service, caused by a NULL pointer dereference when kadmind is configured to use LDAP for the KDC database. A remote authenticated attacker could exploit this vulnerability to cause kadmind to crash.
CVSS Base Score: 3.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/#/vulnerabilities/99346> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVE-ID: CVE-2014-5355 Description: MIT Kerberos is vulnerable to a denial of service, caused by a NULL pointer dereference in the krb5_recvauth function. By sending a non-null-terminated version string, a remote attacker could exploit this vulnerability to cause the service to crash.
CVSS Base Score: 5.0
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100972> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P
CVE-ID: CVE-2014-9421**
Description:** MIT krb5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a double-free error in the kadmind daemon. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.0
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/100841 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)
**
CVE-ID:** CVE-2014-9422**
Description: *MIT krb5 could allow a remote authenticated attacker to bypass security restrictions, caused by the acceptance of authentications to two-component server principals. An attacker could exploit this vulnerability to impersonate arbitrary users.
CVSS Base Score: 6.1
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/100840 for more information
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:C)
IBM Security Network Protection 5.2
IBM Security Network Protection 5.3
Product
| VRMF| Remediation/First Fix
—|—|—
IBM Security Network Protection | Firmware version 5.2| Download 5.2.0.0-ISS-XGS-All-Models-Hotfix-FP0010 from IBM Fix Central and upload and install via the Available Updates page of the local management interface.
IBM Security Network Protection| Firmware version 5.3| Install Fixpack 5.3.1.2 from the Available Updates page of the local management interface, or by performing a One Time Scheduled Installation from SiteProtector.
None