Security Bulletin: Multiple vulnerabilities in Samba, BIND and Libreswan affect IBM Netezza Host Management

Summary

Samba, BIND and Libreswan are used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-2119**
DESCRIPTION:** Samba could allow a remote attacker to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability to inject the SMB2_SESSION_FLAG_IS_GUEST or SMB2_SESSION_FLAG_IS_NULL flags to downgrade the client’s configuration-required signing protections for SMB2 or SMB3 client connections and spoof the server.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114797 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2848**
DESCRIPTION:** ISC BIND is vulnerable to a denial of service. By sending a specially crafted DNS packet with malformed options, a remote attacker could exploit this vulnerability to trigger an assertion failure.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118228 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-3071**
DESCRIPTION:** Libreswan is vulnerable to a denial of service, caused by an error in IKEv2 aes_xcbc transform. By sending a specially-crafted IKE packet, a remote attacker could exploit this vulnerability to cause the IKE daemon to crash and restart.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112389 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Version

| CVE
—|—
IBM Netezza Host Management 5.4.6.0 (and prior releases)| CVE-2016-3071
CVE-2016-2119
CVE-2016-2428

Remediation/Fixes

To resolve the reported CVEs for Red Hat Enterprise Linux (RHEL), and for the most-up-to-date software for the Netezza host operating system, update to the latest IBM Netezza Host Management release:

The Netezza Host Management software contains the latest RHEL updates for the operating systems certified for use on IBM Netezza/PureData System for Analytics appliances. IBM recommends upgrading to the latest Netezza Host Management version to ensure that your hosts have the latest fixes, security changes, and operating system updates. IBM Support can assist you with planning for the Netezza Host Management and operating system upgrades to your appliances.

For more details on IBM Netezza Host Management security patching:

• Red Hat Enterprise Linux (RHEL) Security Patching for IBM PureData System for Analytics appliances