Security Bulletin: IBM Flex System Manager (FSM) is affected by a Pluggable Authentication Module (PAM) vulnerability (CVE-2013-7041)

Summary

A security vulnerability was discovered in PAM that is embedded in the IBM FSM. This bulletin addresses this vulnerabilities.

Vulnerability Details

CVEID: CVE-2013-7041**
DESCRIPTION:** pam_userdb module for Pam could provide weaker than expected security, caused by an error in the strncasecmp() function within the pam_userdb module for Pam on comparison of the stored hash password with the user’s password hash. An attacker could exploit this vulnerability using brute-force techniques to obtain user credentials.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89588 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Flex System Manager 1.3.4.x
Flex System Manager 1.3.3.x
Flex System Manager 1.3.2.x

Remediation/Fixes

IBM recommends updating the FSM using the instructions referenced in this table.

Product |

VRMF |

APAR |

Remediation
—|—|—|—
Flex System Manager|

1.3.4.x |

IT16776

| Ensure the steps in Technote 761981453 are completed, and then install
fsmfix1.3.4.0_IT16772_IT16773_IT16774_IT16776
Flex System Manager|

1.3.3.x |

IT16776

| Ensure the steps in Technote 736218441 are completed and then install
fsmfix1.3.3.0_IT16772_IT16773_IT16774_IT16776
Flex System Manager|

1.3.2.x |

IT16776

| Ensure the steps in Technote 736218441 are completed and then install
fsmfix1.3.2.0_IT16772_IT16773_IT16774_IT16776

For 1.1.x.x, 1.2.x.x, 1.3.0.x and 1.3.1.x IBM recommends upgrading to a fixed, supported version/release of the product.

You should verify applying this fix does not cause any compatibility issues. The fix disables older encrypted protocols by default. If you change the default setting after applying the fix, you will expose yourself to the attack described in IT15244. IBM recommends that you review your entire environment to identify other areas where you have enabled weak encryption and take appropriate mitigation and remediation actions.

Workarounds and Mitigations

none