Security Bulletin
Summary
3 security vulnerabilities have been identified in IBM MessageSight V1.0 and V1.1 allowing a remote attacker to perform a denial of service attack.
A security vulnerability has been identified in IBM MessageSight V1.0 and V1.1 allowing an attacker to log in to the server over SSH using only the first 8 characters of the password.
Vulnerability Details
DESCRIPTION:
When malformed headers are received as part of a WebSockets connection upgrade, there is a chance that the MessageSight server process will crash and then restart, resulting in the loss of all non-persistent messages. See APAR IC98583.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92074 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
DESCRIPTION:
Vulnerability in the code responsible for handling MQTT over WebSockets might allow a remote attacker to consume system resources on the MessageSight server until it is restarted. See APAR IC98692.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92075 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
DESCRIPTION:
Vulnerability in the code responsible for handling MQTT authentication can cause the MessageSight server to be restarted. See APAR IT00582.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92076 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
DESCRIPTION:
IBM MessageSight contains a vulnerability that would allow a remote attacker to bypass security. The server only checks the first 8 characters of a password, thus ignoring any subsequent characters and giving an attacker control over the appliance. See APAR IT00583.
CVSS:
CVSS Base Score: 4.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92077 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P)
Affected Products and Versions
IBM MessageSight 1.0
IBM MessageSight 1.1
Remediation/Fixes
The recommended solution is to apply the fix to all affected versions as soon as practical.
An updated firmware image containing the fix is available from Fix Central: 1.1.0.0-IBM-IMA-IT01015.
This fix also addresses CVE-2014-0160 as described in this technote.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21670278