Lucene search

K
ibmIBMC854D3DFD3F24731F7427D2F122E814A9AFC5BD6245867AB980A6407E71526FE
HistoryJun 02, 2022 - 12:50 p.m.

Security Bulletin: IBM DataPower Gateway Virtual Edition uses out of date ICU libraries in open-vm-tools

2022-06-0212:50:09
www.ibm.com
27

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.026 Low

EPSS

Percentile

90.1%

Summary

Open-vm-tools is used only in IBM DataPower Gateway Virtual Edition for communicating with the Hypervisor to perform such tasks as reboot or shutdown of the VM. The limited functionality employed in this use should not expose these CVEs to exploitation; IBM has addressed the CVEs out of an abundance of caution.

Vulnerability Details

CVEID:CVE-2014-8147
**DESCRIPTION:**ICU Project ICU4C library could allow a local attacker execute arbitrary code on the system, caused by an error in the resolveImplicitLevels function of ubidi.c. By sending an overly long string, an attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/102876 for the current score.
CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P)

CVEID:CVE-2014-8146
**DESCRIPTION:**ICU Project ICU4C library is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by resolveImplicitLevels function of ubidi.c. By sending an overly long string, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/102875 for the current score.
CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P)

CVEID:CVE-2020-10531
**DESCRIPTION:**International Components for Unicode (ICU) for C/C++ is vulnerable to a heap-based buffer overflow, caused by an integer overflow in UnicodeString::doAppend() function in common/unistr.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177660 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2017-14952
**DESCRIPTION:**International Components for Unicode (ICU) for C/C++ could allow a remote attacker to execute arbitrary code on the system, caused by a double free in i18n/zonemeta.cpp. By using a specially crafted string, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/133526 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM DataPower Gateway V10CD 10.0.2.0-10.0.3.0
IBM DataPower Gateway 10.0.1 10.0.1.0-10.0.1.4
IBM DataPower Gateway 2018.4.1 2018.4.1.0-2018.4.1.17

Remediation/Fixes

Affected product Fixed in version APAR
IBM DataPower Gateway V10CD 10.0.4.0 IT37856
IBM DataPower Gateway 10.0.1 10.0.1.5 IT37856
IBM DataPower Gateway 2018.4.1 2018.4.1.18 IT37856

Workarounds and Mitigations

None

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.026 Low

EPSS

Percentile

90.1%