Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2019-14907)

Summary

IBM Storwize V7000 Unified is shipped with Samba, for which a fix is available for a security vulnerability.

Vulnerability Details

CVEID:CVE-2019-14907
**DESCRIPTION:**Samba is vulnerable to a denial of service, caused by an error after a failed character conversion at log level 3 or above. By sending a specially crafted string during the NTLMSSP authentication exchange, an attacker could exploit this vulnerability to cause a long-lived process to terminate.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174912 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

A fix for this issue is in version 1.6.2.8 of IBM Storwize V7000 Unified. Customers running an affected version of V7000 Unified should upgrade to 1.6.2.8 or a later version, so that the fix gets applied.

Latest Storwize V7000 Unified Software

Workarounds and Mitigations

None