Security Bulletin: Vulnerabilities in NTP affect QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter and IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru

Summary

The following vulnerabilities in NTP have been addressed by QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter and IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru.

Vulnerability Details

CVEID: CVE-2018-7183 DESCRIPTION: NTP is vulnerable to a buffer overflow, caused by improper bounds checking by the decodearr function. By leveraging an ntpq query and sending a response with a crafted array, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/140092&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-7185 DESCRIPTION: NTP is vulnerable to a denial of service. By sending specially crafted packets, a remote authenticated attacker could exploit this vulnerability to reset authenticated interleaved association.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139783&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-7170 DESCRIPTION: NTP could allow a remote authenticated attacker to bypass security restrictions, caused by a Sybil attack. By creating many ephemeral associations, an attacker could exploit this vulnerability to win the clock selection of ntpd and modify a victim’'s clock.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139786&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-7182 DESCRIPTION: NTP could allow a remote attacker to obtain sensitive information, caused by a leak in the ctl_getitem() function. By sending a specially crafted mode 6 packet, an attacker could exploit this vulnerability to read past the end of its buffer.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139785&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-7184 DESCRIPTION: NTP is vulnerable to a denial of service, caused by the failure of the interleaved symmetric mode to recover from bad state. By sending specially crafted packets, a remote authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139784&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Product

|

Affected Version

—|—

IBM Flex System FC3171 8Gb SAN Switch and
IBM Flex System FC3171 8Gb SAN Pass-thru Firmware Update

|

9.1

QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module
for IBM BladeCenter Firmware Update

| 7.10

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Product

|

Fix Version

—|—

IBM Flex System FC3171 8Gb SAN Switch and
IBM Flex System FC3171 8Gb SAN Pass-thru Firmware Update
(qlgc_fw_flex_9.1.14.02.00_anyos_noarch)

|

9.1.14.02.00

QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter Firmware Update
(qlgc_fw_bcsw_7.10.1.45.00_anyos_noarch)

| 7.10.1.45.00

Workarounds and Mitigations

None