Security Bulletin: Vulnerabilities in krb5, giflib and freetype2 affect IBM BladeCenter Advanced Management Module (AMM) and IBM Flex System Chassis Management Module (CMM)

Summary

IBM BladeCenter Advanced Management Module (AMM) and IBM Flex System Chassis Management Module (CMM) have addressed the following vulnerabilities.

Vulnerability Details

Summary

IBM BladeCenter Advanced Management Module (AMM) and IBM Flex System Chassis Management Module (CMM) have addressed the following vulnerabilities.

Vulnerability Details

CVEID: CVE-2015-8629

Description: MIT Kerberos could allow a remote authenticated attacker to obtain sensitive information, caused by a null termination in the xdr_nullstring() function. By sending specially-crafted data, an attacker could exploit this vulnerability to obtain sensitive information from the memory.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/110395&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8631

Description: MIT Kerberos is vulnerable to a denial of service, caused by the leak of the client and server name by the rb5_unparse_name() function. By sending specially-crafted data, a remote authenticated attacker could exploit this vulnerability to consume all available memory resources.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/110393&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-3119

Description: MIT Kerberos is vulnerable to a denial of service, caused by a NULL pointer dereference in the process_db_args() function. By sending a specially crafted modify_principal command with an empty DB argument, a remote authenticated attacker could exploit this vulnerability to cause a denial of service.

CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/111772&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-3977

Description: giflib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by util/gif2rgb.c. By using a specially-crafted .gif file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112618&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2014-9656

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow in the tt_sbit_decoder_load_image function. A remote attacker could exploit this vulnerability using specially-crafted OpenType font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100796&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9657

Description: FreeType is vulnerable to a denial of service, caused by an out-of-bounds read in the tt_face_load_hdmx function. A remote attacker could exploit this vulnerability using specially-crafted TrueType font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100797&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9658

Description: FreeType is vulnerable to a denial of service, caused by an error in the tt_face_load_kern function. A remote attacker could exploit this vulnerability using specially-crafted TrueType font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100798&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9659

Description: FreeType is vulnerable to a stack buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer using specially-crafted OpenType font and execute arbitrary code on the system or cause a denial of service.

CVSS Base Score: 6.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100799&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-9660

Description: FreeType is vulnerable to a denial of service, caused by a NULL pointer dereference in the _bdf_parse_glyphs function. A remote attacker could exploit this vulnerability using specially-crafted BDF font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100800&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9661

Description: FreeType is vulnerable to a denial of service, caused by an use-after-free error in type42/t42parse.c. A remote attacker could exploit this vulnerability using specially-crafted Type42 font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100801&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9662

Description: FreeType is vulnerable to a denial of service, caused by a heap-based buffer overflow in cff/cf2ft.c. A remote attacker could exploit this vulnerability using specially-crafted OTF font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100823&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9663

Description: FreeType is vulnerable to a denial of service, caused by an out-of-bounds read in the tt_cmap4_validate function. A remote attacker could exploit this vulnerability using specially-crafted cmap SFNT table to cause the a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100822&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9664

Description: FreeType is vulnerable to a denial of service, caused by a parsing error in type42/t42parse.c and type1/t1load.c . A remote attacker could exploit this vulnerability using specially-crafted Type42 font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100830&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9665

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow and the heap-based buffer overflow in the Load_SBit_Png function. A remote attacker could exploit this vulnerability using specially-crafted font files to cause a denial of service

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100805&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9666

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow and out-of-bounds read in the tt_sbit_decoder_init function. A remote attacker could exploit this vulnerability using specially-crafted embedded bitmap to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100804&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9667

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow and out-of-bounds read in sfnt/ttload.c. A remote attacker could exploit this vulnerability using specially-crafted SFNT table to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100803&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9668

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow and heap-based buffer overflow in the woff_open_font function. A remote attacker could exploit this vulnerability using a specially-crafted WOFF file to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100802&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9669

Description: FreeType is vulnerable to a denial of service, caused by multiple integer overflows in sfnt/ttcmap.c. A remote attacker could exploit this vulnerability using specially-crafted cmap SFNT table to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100824&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9670

Description: FreeType is vulnerable to a denial of service, caused by multiple integer signedness errors in the pcf_get_encodings function. A remote attacker could exploit this vulnerability using specially-crafted PCF files to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100825&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9671

Description: FreeType is vulnerable to a denial of service, caused by an off-by-one error in the pcf_get_properties function. A remote attacker could exploit this vulnerability using specially-crafted PCF files to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100826&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9672

Description: FreeType is vulnerable to a denial of service, caused by an array index error in the parse_fond function. A remote attacker could exploit this vulnerability using specially-crafted FOND resource to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100827&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9673

Description: FreeType is vulnerable to a denial of service, caused by an integer signedness error in the Mac_Read_POST_Resource function. A remote attacker could exploit this vulnerability using specially-crafted Mac font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100828&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9674

Description: FreeType is vulnerable to a denial of service, caused by an integer overflow and heap-based buffer overflow in the Mac_Read_POST_Resource function. A remote attacker could exploit this vulnerability using specially-crafted Mac font to cause a denial of service.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100829&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9675

Description: FreeType could allow a remote attacker to bypass security restrictions, caused by an error in bdf/bdflib.c. An attacker could exploit this vulnerability using specially-crafted font file to bypass ASLR features.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100821&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-9745

Description: FreeType is vulnerable to a denial of service, caused by improper validation in parse_encode() function in 'src/type1/t1load.c. By using a specially-crafted FreeType font, a remote attacker could exploit this vulnerability to cause the application to crash.

CVSS Base Score: 3.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/106351&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L)

CVEID: CVE-2014-9747

Description: FreeType is vulnerable to denial of service, caused by the failure to properly update the current position for immediates-only mode by the t42_parse_encoding function in type42/t42parse.c. An attacker could exploit this vulnerability using a Type42 font to cause the application to enter into an infinite loop.

CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/114236&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Product	Affected Version
IBM BladeCenter Advanced Management Module (AMM)	BPET
IBM Flex System Chassis Management Module (CMM)	2PET

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Product	Fix Version
IBM BladeCenter Advanced Management Module (AMM)
(ibm_fw_amm_bbet66z-3.66z_anyos_noarch)	BPET66Z
IBM Flex System Chassis Management Module (CMM)
(ibm_fw_cmm_2pet14h-2.5.8h_anyos_noarch)	2PET14H

Workarounds and Mitigations

None.

References

• Complete CVSS V2 Guide
• On-line Calculator V2
• Complete CVSS V3 Guide
• On-line Calculator V3

Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Lenovo Product Security Advisories

Acknowledgement

None.

Change History
31 March, 2017: Original Version Published

• The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.