Security Bulletin: IBM SAN Volume Controller and Storwize Family security vulnerabilities (CVE-2013-4310 CVE-2013-4316)

Summary

Security Bulletin: IBM SAN Volume Controller and Storwize Family security vulnerabilities (CVE-2013-4310 CVE-2013-4316)

Vulnerability Details

Security Bulletin

Summary

Administrative access to the system via the IP interface may be obtained without authentication.

Vulnerability Details

CVEID: CVE-2013-4310 CVE-2013-4316 DESCRIPTION:

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

CVE-2013-4310
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87336 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

DESCRIPTION:

An unspecified error in Apache Struts related to the default enabling of Dynamic Method Invocation (DMI) could lead to remote code execution.

CVE-2013-4316
CVSS Base Score: 10.0
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87373 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM SAN Volume Controller
Storwize V7000 for Lenovo
Storwize V5000 for Lenovo
Storwize V3700 for Lenovo
Storwize V3500 for Lenovo

All products affected when running a version below V6.4.1.7 or V7.1.0.6.

Remediation/Fixes

For IBM SAN Volume Controller, Storwize V7000, V5000, V3700 and V3500 for Lenovo and IBM Flex System V7000, install the V6.4.1.7 or V7.1.0.6 PTF level or higher.

Workarounds and Mitigations

Access to the system’s IP interface can be restricted, for example using a private network or firewall technology. Only users with access to the IP interface can exploit the vulnerability.