Security Bulletin
Summary
CIT scanner component contains format string vulnerability in wscanhw executable and stack overflow vulnerability in wscansw executable.
Successful exploitation of the vulnerabilities allows for scanner process manipulation, and possibly crashing the process.
Vulnerability Details
CVEID: CVE-2014-8927
DESCRIPTION: IBM License Metric Tool contains a disruption of service vulnerability. A remote user can issue a specially crafted XML query to increase CPU usage and cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99432 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVEID: CVE-2014-8926
DESCRIPTION: IBM License Metric Tool contains a disruption of service vulnerability. A remote user can issue a specially crafted XML query to increase CPU usage and cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99431 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected Products and Versions
IBM License Metric Tool v9, v7.5, 7.2.2
IBM Endpoint Manger for Software Use Analysis v9
IBM Tivoli Asset Discovery for Distributed v7.5, v7.2.2
Remediation/Fixes
- Refer to the following technote with information on how to download and apply fixed CIT component: http://www.ibm.com/support/docview.wss?uid=swg24040006. The CIT component needs to be updated on each computer where CIT component is installed. Please mind, that in the case of both v9 products, the "5724-D33" identifier in the CIT installation command should be replaced by "SUA" identifier.
- With the next v9 release the fixed CIT component will be available on IBM Endpoint Manager sites for the v9 products.
- With the next v7.5 and v7.2.2 releases the fixed CIT component will be available as a part of self-update functionality. This technote will be updated with releases information as they become available.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
The vulnerability was reported to IBM by Vincent Ruijter (Verizon Enterprise Solutions), vincentrr91@gmail.com
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
26 April 2021
UID
swg21882695