Security Bulletin: Multiple vulnerabilities affect the IBM FlashSystem model V840

Summary

Multiple vulnerabilities exist in IBM FlashSystem™ V840.

Vulnerability Details

CVEID: CVE-2018-1433 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products’ web handler /DownloadFile does not require authentication to read arbitrary files from the system.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139473 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-1434 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139474 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

CVEID: CVE-2018-1438 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products’ web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139566 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-1461 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/140362 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2018-1462 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products could allow an authenticated user to access system files they should not have access to including deleting files or causing a denial of service.
CVSS Base Score: 7.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/140363 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)

CVEID: CVE-2018-1463 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products could allow an authenticated user to access system files they should not have access to some of which could contain account credentials.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/140368 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-1464**
DESCRIPTION:** IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products could allow an authenticated user to obtain sensitive information that they should not have authorization to read.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/140395&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-1465 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products could allow an authenticated user to obtain the private key which could make intercepting GUI communications possible.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/140396 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-1466 DESCRIPTION: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/140397 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Storage Node machine type and models (MTMs) affected: 9840-AE1 and 9843-AE1
Controller Node MTMs affected: 9846-AC0, 9848-AC0, 9846-AC1, and 9848-AC1

Supported storage node code versions which are affected

• VRMFs prior to 1.3.0.10
• VRMFs prior to 1.4.8.0
• VRMFs prior to 1.5.1.1

Supported controller node code versions which are affected

• VRMFs prior to 7.7.1.9
• VRMFs prior to 7.8.1.6
• VRMFs prior to 8.1.1.2

Remediation/Fixes

MTMs

| VRMF| APAR| Remediation/First Fix
—|—|—|—
Storage nodes:
9846-AE1 &
9848-AE1

Controller nodes:
9846-AC0,
9846-AC1,
9848-AC0, &
9848-AC1| Code fixes are now available, the minimum VRMF containing the fix depends on the code stream:_ _
__Fixed Code VRMF __
_1.5 stream: 1.5.1.1 _
1.4 stream: 1.4.8.0
1.3 stream: 1.3.0.10

__Controller Node VRMF __
8.1 stream: 8.1.1.2
7.8 stream: 7.8.1.6
7.7 stream: 7.7.1.9| _ _N/A| FlashSystem V840 fixes**for storage and controller node **are available @ IBM’s Fix Central

Workarounds and Mitigations

Customers running the 1.3 code version should be aware that 1.3.0.10 is the last planned release for the 1.3 code stream and that it will no longer be supported from a security fix point of view going forward. These customers should consider upgrading to either 1.4.8.0 or 1.5.1.1 to pick up these security fixes in these newer code streams which will continue to be supported.