IBM94ADF9C910A362467000D0DD8590BD5C24E2AED265E1E3B9AB7A109A4D0AF94FSecurity Bulletin: A libxml vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-1819)
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
Summary
IBM Security Access Manager for Mobile is affected by a denial of service vulnerability in libxml2.
Vulnerability Details
CVEID: CVE-2015-1819**
DESCRIPTION:** Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error in the xmlreader when processing XML data. A remote attacker could exploit this vulnerability to consume all available memory resources.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107272 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
IBM Security Access Manager for Mobile 8.0 appliances, all firmware versions
IBM Security Access Manager 9.0 appliances, all firmware versions
Remediation/Fixes
The table below provides links to patches for all affected versions. Follow the installation instructions in the README file included with the patch.
| Product | VRMF | APAR | Remediation |
|---|---|---|---|
| IBM Security Access Manager for Mobile | 8.0 - 8.0.1.3 | IV80972 | 1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3: |
| 8.0.1-ISS-ISAM-FP0003 | |||
| 2. Apply 8.0.1.3 Interim Fix 4: | |||
| 8.0.1.3-ISS-ISAM-IF0004 | |||
| IBM Security Access Manager | 9.0 | IV80971 | 1. Upgrade to 9.0.0.1: |
| 9.0.0-ISS-ISAM-FP0001 | |||
| 2. Apply 9.0.0.1 Interim Fix 1: | |||
| 9.0.0.1-ISS-ISAM-IF0001 |
Workarounds and Mitigations
None.
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P