Lucene search

IBMEA5B6E90E6C261937D8095E9230342C2A9F41DE8B8307B5FFD9C12FE71507789

HistoryJun 10, 2023 - 8:23 a.m.

Security Bulletin: IBMid credentials may be exposed when directly downloading code onto IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Spectrum Virtualize products [CVE-2023-27870]

2023-06-1008:23:49

www.ibm.com

ibm

san volume controller

storwize

flashsystem

spectrum virtualize

credentials

download

code

vulnerability

disclosure

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

41.1%

JSON

Summary

If using the “satask downloadsoftware” command or the “Obtain the package directly” option in the GUI to update the system on IBM SAN Volume Controller, IBM Storwize and IBM FlashSystem products which run IBM Spectrum Virtualize software, the IBMid credentials used to authenticate to Fix Central may be exposed under certain circumstances while the download is in progress. [CVE-2023-27870]

Vulnerability Details

CVEID:CVE-2023-27870
**DESCRIPTION:**IBM Spectrum Virtualize, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/249518 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Spectrum Virtualize	8.5

Note that this applies to all IBM SAN Volume Controller, IBM Storwize and IBM FlashSystem products which run IBM Spectrum Virtualize software.

Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9500, IBM FlashSystem 9100 Family, IBM FlashSystem 9200, IBM FlashSystem 7300, IBM FlashSystem 7200, IBM FlashSystem 5200 and IBM FlashSystem 5000 to the following code levels or higher:

8.5.0.8

8.6.0.0

Please ensure that you follow the steps described in “Workarounds and Mitigations” to apply the update.

Latest IBM SAN Volume Controller Code
Latest IBM Storwize V7000 Code
Latest IBM Storwize V5000 and V5100 Code
Latest IBM Storwize V5000E Code
Latest IBM FlashSystem V9000 Code
Latest IBM FlashSystem 9500 Code
Latest IBM FlashSystem 9100 Family Code
Latest IBM FlashSystem 9200 Code
Latest IBM FlashSystem 7300 Code
Latest IBM FlashSystem 7200 Code
Latest IBM FlashSystem 5000 and 5200 Code
Latest IBM Spectrum Virtualize Software
Latest IBM Spectrum Virtualize for Public Cloud

Workarounds and Mitigations

Until you have applied the fix, a temporary alternative is available:

Do not use the “Obtain the package directly” feature in the GUI (available in 8.5.4 and above) or the satask downloadsoftware command on the CLI.
Navigate to the Fix Central website in a separate browser window, download the update package and then upload it in the GUI using the “Provide the package manually” option in the Update System panel (or simply “Update System” prior to 8.5.4).

Affected configurations

Vulners

Node

ibmstorwize_v7000Match8.5

ibmstorwize_v5000e_firmwareMatch8.5

ibmflashsystem_v9000Match8.5

ibmibm_flashsystem_7300Match8.5

ibmspectrum_virtualize_for_public_cloudMatch8.5

ibmibm_flashsystem_7200Match8.5

ibmsan_volume_controllerMatch8.5

ibmstorwize_v5000Match8.5

ibmspectrum_virtualize_softwareMatch8.5

ibmibm_flashsystem_9x00Match8.5

ibmspectrum_virtualize_softwareMatch8.5

ibmibm_flashsystem_9500Match8.5

ibmibm_flashsystem_5x00Match8.5

VendorProductVersionCPE
ibmstorwize_v70008.5cpe:2.3:h:ibm:storwize_v7000:8.5:*:*:*:*:*:*:*
ibmstorwize_v5000e_firmware8.5cpe:2.3:o:ibm:storwize_v5000e_firmware:8.5:*:*:*:*:*:*:*
ibmflashsystem_v90008.5cpe:2.3:h:ibm:flashsystem_v9000:8.5:*:*:*:*:*:*:*
ibmibm_flashsystem_73008.5cpe:2.3:a:ibm:ibm_flashsystem_7300:8.5:*:*:*:*:*:*:*
ibmspectrum_virtualize_for_public_cloud8.5cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:8.5:*:*:*:*:*:*:*
ibmibm_flashsystem_72008.5cpe:2.3:a:ibm:ibm_flashsystem_7200:8.5:*:*:*:*:*:*:*
ibmsan_volume_controller8.5cpe:2.3:h:ibm:san_volume_controller:8.5:*:*:*:*:*:*:*
ibmstorwize_v50008.5cpe:2.3:h:ibm:storwize_v5000:8.5:*:*:*:*:*:*:*
ibmspectrum_virtualize_software8.5cpe:2.3:a:ibm:spectrum_virtualize_software:8.5:*:*:*:*:*:*:*
ibmibm_flashsystem_9x008.5cpe:2.3:a:ibm:ibm_flashsystem_9x00:8.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	storwize_v7000	8.5	cpe:2.3:h:ibm:storwize_v7000:8.5:::::::*
ibm	storwize_v5000e_firmware	8.5	cpe:2.3:o:ibm:storwize_v5000e_firmware:8.5:::::::*
ibm	flashsystem_v9000	8.5	cpe:2.3:h:ibm:flashsystem_v9000:8.5:::::::*
ibm	ibm_flashsystem_7300	8.5	cpe:2.3:a:ibm:ibm_flashsystem_7300:8.5:::::::*
ibm	spectrum_virtualize_for_public_cloud	8.5	cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:8.5:::::::*
ibm	ibm_flashsystem_7200	8.5	cpe:2.3:a:ibm:ibm_flashsystem_7200:8.5:::::::*
ibm	san_volume_controller	8.5	cpe:2.3:h:ibm:san_volume_controller:8.5:::::::*
ibm	storwize_v5000	8.5	cpe:2.3:h:ibm:storwize_v5000:8.5:::::::*
ibm	spectrum_virtualize_software	8.5	cpe:2.3:a:ibm:spectrum_virtualize_software:8.5:::::::*
ibm	ibm_flashsystem_9x00	8.5	cpe:2.3:a:ibm:ibm_flashsystem_9x00:8.5:::::::*

Rows per page:

1-10 of 121

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

41.1%

JSON

Related for EA5B6E90E6C261937D8095E9230342C2A9F41DE8B8307B5FFD9C12FE71507789