Security Bulletin: Multiple vulnerabilities in Network Time Protocol (NTP) affect IBM Virtualization Engine TS7700 (CVE-2016-7427, CVE-2016-7428, CVE-2016-9310, CVE-2016-9311)

Security Bulletin

Summary

There are multiple vulnerabilities in the Network Time Protocol (NTP) implementation embedded within the IBM Virtualization Engine TS7700.

Vulnerability Details

CVEID: CVE-2016-7427
DESCRIPTION: NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119088 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-7428
DESCRIPTION: NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119089 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9310
DESCRIPTION: NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119087 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

CVEID: CVE-2016-9311
DESCRIPTION: NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119086 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

All versions of microcode for the IBM Virtualization Engine TS7700 (3957-V06, 3957-V07, 3957-VEA, 3957-VEB, 3957-VEC) prior to and including the following are affected:

Machine Type	Model	Version
3957	V06	8.21.0.178
3957	VEA	8.21.0.178
3957	V07	8.41.200.113
3957	VEB	8.41.200.113
3957	VEC	8.41.200.113

Remediation/Fixes

Contact IBM Service at 1-800-IBM-SERV to arrange an upgrade to the latest microcode version followed by the installation of VTD_EXEC.103 and VTD_EXEC.279 as needed. Minimum microcode versions are shown below:

Machine Type	Model	Fix
3957	V06	Upgrade to 8.21.0.178 + VTD_EXEC.103 + VTD_EXEC.279
3957	VEA	Upgrade to 8.21.0.178 + VTD_EXEC.103 + VTD_EXEC.279
3957	V07	Upgrade to 8.33.3.14 + VTD_EXEC.279 -OR- Upgrade to 8.40.2.12 + VTD_EXEC.279 -OR- Upgrade to 8.41.101.10 + VTD_EXEC.103 + VTD_EXEC.279 -OR- Upgrade to 8.41.200.113 + VTD_EXEC.279
3957	VEB	Upgrade to 8.33.3.14 + VTD_EXEC.279 -OR- Upgrade to 8.40.2.12 + VTD_EXEC.279 -OR- Upgrade to 8.41.101.10 + VTD_EXEC.103 + VTD_EXEC.279 -OR- Upgrade to 8.41.200.113 + VTD_EXEC.279
3957	VEC	Upgrade to 8.40.2.12 + VTD_EXEC.279 -OR- Upgrade to 8.41.101.10 + VTD_EXEC.103 + VTD_EXEC.279 -OR- Upgrade to 8.41.200.113 + VTD_EXEC.279

The minimum VTD_EXEC version is shown below:

VTD_EXEC Package	Version
VTD_EXEC.103	v1.68
VTD_EXEC.279	v1.08

Workarounds and Mitigations

Although IBM recommends that you upgrade to the fixes identified above, you can mitigate, but not eliminate the risk of these vulnerabilities by restricting physical and network access to the TS7700 to authorized users and IBM Service Personnel only.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Change History

8 May 2018: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"STFS69","label":"IBM TS7700 Virtual Tape Library"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"Not Applicable","Platform":[{"code":"","label":"N\/A"}],"Version":"Not Applicable","Edition":"N\/A","Line of Business":{"code":"LOB26","label":"Storage"}}]

Tips

Security Bulletin: Multiple vulnerabilities in Network Time Protocol (NTP) affect IBM Virtualization Engine TS7700 (CVE-2016-7427, CVE-2016-7428, CVE-2016-9310, CVE-2016-9311)