Security Bulletin: Authd service in the IBM Verify Gateway PAM components allows cleartext transmission of sensitive information (CVE-2020-4397)

Summary

The IBM Verify Gateway (IVG) Authd service listens on TCP port 12. When the service is enabled, it’s possible to detect cleartext transmission of sensitive information in the data traffic to and from the port. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the Authd service is not used. The PAM module now goes directly to the tenant using TLS encryption.

Vulnerability Details

CVEID:CVE-2020-4397
**DESCRIPTION:**IBM Verify Gateway (IVG) transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179428 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Log in to IBM X-Force Exchange / App Exchange and download and install the latest IBM Security Verify Gateway (renamed from IBM Verify Gateway) PAM components. Specifically:

• IBM Security Verify Gateway for AIX PAM (Pluggable Authentication Modules) v1.0.1 at <https://exchange.xforce.ibmcloud.com/hub/extension/e506cf66c5f51340cef3e1b40e8b4840&gt;
• IBM Security Verify Gateway for Linux PAM (Pluggable Authentication Modules) v1.0.2 at <https://exchange.xforce.ibmcloud.com/hub/extension/80eca9a1094b416db69dfff40eb10c5a&gt;

Workarounds and Mitigations

None