Security Bulletin: IBM API Connect is impacted by multiple vulnerabilities in PHP (CVE-2019-11045, CVE-2019-11044, CVE-2019-11046)

Summary

IBM API Connect has addressed the following vulnerabilities.

Vulnerability Details

CVEID:CVE-2019-11045
**DESCRIPTION:**PHP could allow a remote attacker to bypass security restrictions, caused by an issue when DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173633 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2019-11044
**DESCRIPTION:**PHP could allow a remote attacker to bypass security restrictions, caused by an issue when link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173632 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2019-11046
**DESCRIPTION:**PHP could allow a remote attacker to obtain sensitive information, caused by improper input validation by the bcmath extension functions. By using a specially-crafted string containing characters that are numeric but not ASCII numbers, an attacker could exploit this vulnerability to obtain content of some memory locations, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173634 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Affected Product

|

Addressed in VRMF

|

APAR

|

Remediation / First Fix

—|—|—|—

IBM API Connect

V5.0.0.0-5.0.8.7

| 5.0.8.8| LI81408| Addressed in IBM API Connect V5.0.8.8.

Developer Portal is impacted.

Follow this link and find the “Portal” package:

http://www.ibm.com/support/fixcentral/swg/quickorder

IBM API Connect

V2018.4.1.0-2018.4.1.10

| 2018.4.1.11| LI81408|

Addressed in IBM API Connect V2018.4.1.11

Developer Portal is impacted.

Follow this link and find the “Portal” package:

http://www.ibm.com/support/fixcentral/swg/quickorder

Workarounds and Mitigations

None