Security Bulletin: IBM Verify Gateway PAM components include a leftover debug file (CVE-2020-4371)

Summary

The IBM Verify Gateway (IVG) PAM components include a leftover header file in their installation packages. The file was needed for debugging during development and shouldn’t be part of the delivered PAM components. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the file has been removed from the installation packages.

Vulnerability Details

CVEID:CVE-2020-4371
**DESCRIPTION:**IBM Verify Gateway (IVG) contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179008 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Log in to IBM X-Force Exchange / App Exchange and download and install the latest IBM Security Verify Gateway (renamed from IBM Verify Gateway) PAM components. Specifically:

• IBM Security Verify Gateway for AIX PAM (Pluggable Authentication Modules) v1.0.1 at <https://exchange.xforce.ibmcloud.com/hub/extension/e506cf66c5f51340cef3e1b40e8b4840&gt;
• IBM Security Verify Gateway for Linux PAM (Pluggable Authentication Modules) v1.0.2 at <https://exchange.xforce.ibmcloud.com/hub/extension/80eca9a1094b416db69dfff40eb10c5a&gt;

Workarounds and Mitigations

None