Security Bulletin: Daeja ViewONE Professional, Standard & Virtual does not have limits for large or slow workloads.

Summary

ViewONE does not ensure that content is small enough before completing work, nor does it have timeouts for some processes.

Vulnerability Details

CVEID: CVE-2017-1212**
DESCRIPTION:** IBM Daeja ViewONE Professional, Standard & Virtual is vulnerable to a denial of service when viewing or opening a large file.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/123852 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

Product Name

|

Affected Versions

—|—
Daeja ViewONE Virtual| 5.0.0
Daeja ViewONE Professional, Standard & Virtual| 4.1.5

Remediation/Fixes

Customer should apply the version of ViewONE that contains the fixes.

Product

|

VRMF

|

APAR

|

Remediation / First Fix

—|—|—|—
Daeja ViewONE Virtual| 5.0.0| NA| Use IBM Daeja ViewONE Virtual 5.0.2.0 iFix001
Daeja ViewONE Professional, Standard & Virtual| 4.1.5| NA| Use IBM Daeja ViewONE 4.1.5.1 iFix022

Workarounds and Mitigations

None