Lucene search

K
ibmIBM308F921F73A3C60B7A5A9E36A94A949671CBB28815EE517580530E7C7EE1870A
HistoryFeb 23, 2024 - 8:45 p.m.

Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to an unspecified vulnerability and denial of service due to IBM Runtime Environment Java Technology Edition

2024-02-2320:45:29
www.ibm.com
15
ibm sterling connect:direct
unix
ibm java
aix
linux
solaris
cve-2023-22081
cve-2023-5676
upgrade

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

Summary

IBM Java is used by IBM Sterling Connect:Direct for UNIX on AIX, Linux, and Solaris platforms in product configuration, management, and data transmission. IBM Sterling Connect:Direct for UNIX on AIX, Linux, and Solaris platforms is impacted by an unspecified vulnerability and denial of service due to IBM Java. IBM Sterling Connect:Direct for UNIX on AIX, Linux, and Solaris platforms has upgraded IBM Java to version 8.0.8.15 to address the issues.

Vulnerability Details

CVEID:CVE-2023-22081
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268929 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2023-5676
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite busy hang on a spinlock or a segmentation fault.
CVSS Base score: 4.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271615 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Sterling Connect:Direct for UNIX 6.0.0.0 - 6.0.0.2.iFix161
IBM Sterling Connect:Direct for UNIX 6.1.0.0 - 6.1.0.4.iFix102
IBM Sterling Connect:Direct for UNIX 6.2.0.0 - 6.2.0.7.iFix004
IBM Sterling Connect:Direct for UNIX 6.3.0.0 - 6.3.0.2.iFix004

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading

Product Version Remediation/Fix/Instructions
IBM Sterling Connect:Direct for UNIX 6.3.0 Apply 6.3.0.2.iFix005, available on Fix Central.
IBM Sterling Connect:Direct for UNIX 6.2.0 Apply 6.2.0.7.iFix005, available on Fix Central.
IBM Sterling Connect:Direct for UNIX 6.1.0 Apply 6.1.0.4.iFix103, available on Fix Central.
IBM Sterling Connect:Direct for UNIX 6.0.0 Apply 6.0.0.2.iFix162, available on Fix Central.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsterling_connect\Matchdirect6.3.0
OR
ibmsterling_connect\Matchdirect6.2.0
OR
ibmsterling_connect\Matchdirect6.1.0
OR
ibmsterling_connect\Matchdirect6.0.0

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%