Security Bulletin: Vulnerabilities in httpd affect IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance

Summary

Vulnerabilities have been identified for httpd packages in Open Source Apache HTTP Server that affect IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance (CVE-2014-0118, CVE-2014-0226, CVE-2014-0231).

Vulnerability Details

CVE-ID: CVE-2014-0118
DESCRIPTION: The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) using crafted request data that decompresses to a much larger size.
CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94675&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2014-0226
DESCRIPTION: Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code using a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
CVSS Base Score: 7.5
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/94678&gt;_ for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2014-0231
DESCRIPTION: The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) using a request to a CGI script that does not read from its stdin file descriptor.
CVSS Base Score: 5.0
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94674&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance

Remediation/Fixes

The recommended solution is download IBM SmartCloud Provisioning 2.1 Fix Pack 5 for Software Virtual Appliance Interim Fix 2 from Fix Central and apply it as soon as practical.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to [My Notifications](< http://www-01.ibm.com/software/support/einfo.html&gt;) to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

• 28 November 2014: original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES ““AS IS”” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Internal Use Only

CVE-Ids: CVE-2014-0118, CVE-2014-0226, CVE-2014-0231

[{“Product”:{“code”:“SSZH3R”,“label”:“IBM Service Agility Accelerator for Cloud”},“Business Unit”:{“code”:“BU053”,“label”:“Cloud & Data Platform”},“Component”:“Security”,“Platform”:[{“code”:“PF016”,“label”:“Linux”}],“Version”:“2.1;2.1.0.1;2.1.0.2;2.1.0.3”,“Edition”:“”,“Line of Business”:{“code”:“LOB45”,“label”:“Automation”}}]