Security Bulletin:Multiple vulnerabilities in PCRE affect IBM Tivoli Network Manager IP Edition

Summary

Multiple vulnerabilities exist in PCRE v5.x, shipped with IBM Tivoli Network Manager IP Edition. Therefore PCRE 8.35 has been upgraded in IBM Tivoli Network Manager IP Edition.

Vulnerability Details

CVE-ID: CVE-2015-2327
Description: PCRE is vulnerable to a denial of service, caused by the improper handling of patterns with certain recursion. A remote attacker could exploit this vulnerability using a specially crafted regular expression to cause a segmentation fault.
CVSS Base Score: 5.300
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/109275&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVE-ID: CVE-2015-2328
Description: PCRE is vulnerable to a denial of service, caused by the improper handling of patterns with certain internal recursive back references. A remote attacker could exploit this vulnerability using a specially crafted regular expression to cause a segmentation fault.
CVSS Base Score: 5.300
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/109276&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

AffectedProduct

| VRMF|APAR|Remediation/First Fix
—|—|—|—
Tivoli Network Manager IP Edition| 3.8.0.7| IV81816| Fix to be deliver on demand
Please call IBM service and reference APAR IV81816, to obtain a fix.
Tivoli Network Manager IP Edition| 3.9.0.4/IF01| IV81816| https://www-01.ibm.com/support/docview.wss?uid=swg24037809
Tivoli Network Manager IP Edition | 4.1| IV81816| Fix to be deliver on demand
Please call IBM service and reference APAR IV81816, to obtain a fix.
Tivoli Network Manager IP Edition| 4.1.1.1 | IV81816| Interim Fix to be release on or before Oct 29th_._
Tivoli Network Manager IP Edition| 4.2| IV81816| PCRE has been upgraded in 42 FP1.http://www-01.ibm.com/support/docview.wss?uid=swg24042425_ _

Remediation/Fixes

29 Oct 2016: Original document published

Workarounds and Mitigations

None