Security Bulletin: Multiple vulnerabilities in IBM MessageSight (CVE-2014-0921, CVE-2014-0922, CVE-2014-0923, CVE-2014-0924)

Security Bulletin


Summary

3 security vulnerabilities have been identified in IBM MessageSight V1.0 and V1.1 allowing a remote attacker to perform a denial of service attack.

A security vulnerability has been identified in IBM MessageSight V1.0 and V1.1 allowing an attacker to log in to the server over SSH using only the first 8 characters of the password.

Vulnerability Details

DESCRIPTION:
When malformed headers are received as part of a WebSockets connection upgrade, there is a chance that the MessageSight server process will crash and then restart, resulting in the loss of all non-persistent messages. See APAR IC98583.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92074 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

DESCRIPTION:
Vulnerability in the code responsible for handling MQTT over WebSockets might allow a remote attacker to consume system resources on the MessageSight server until it is restarted. See APAR IC98692.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92075 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

DESCRIPTION:
Vulnerability in the code responsible for handling MQTT authentication can cause the MessageSight server to be restarted. See APAR IT00582.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92076 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

DESCRIPTION:
IBM MessageSight contains a vulnerability that would allow a remote attacker to bypass security. The server only checks the first 8 characters of a password, thus ignoring any subsequent characters and giving an attacker control over the appliance. See APAR IT00583.

CVSS:
CVSS Base Score: 4.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92077 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P)

Affected Products and Versions

IBM MessageSight 1.0
IBM MessageSight 1.1

Remediation/Fixes

The recommended solution is to apply the fix to all affected versions as soon as practical.

An updated firmware image containing the fix is available from Fix Central: 1.1.0.0-IBM-IMA-IT01015.

This fix also addresses CVE-2014-0160 as described in this technote.

Workarounds and Mitigations

None

References

Related information

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Document information


More support for:

IBM MessageSight
Security

Software version:

1.0, 1.1

Operating system(s):

Platform Independent

Reference #:

1670278

Modified date:

2014-04-14

Translate my page

Machine Translation

Content navigation