IBMD7223669F837AB80390958B899F52861611C307D6B8D138B8989B36879EA3A71Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to zlib (CVE-2018-25032)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
67.9%
Summary
There is a vulnerability in the zlib library used by IBM Sterling Connect:Direct for UNIX. IBM Sterling Connect:Direct for UNIX has addressed the applicable issue.
Vulnerability Details
CVEID:CVE-2018-25032
**DESCRIPTION:**Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222615 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling Connect:Direct for UNIX | 6.2.0 |
| IBM Sterling Connect:Direct for UNIX | 6.1.0 |
| IBM Sterling Connect:Direct for UNIX | 6.0.0 |
| IBM Sterling Connect:Direct for UNIX | 4.3.0 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading
| Product | Version | Remediation/Fix/Instructions |
|---|---|---|
| IBM Sterling Connect:Direct for UNIX | 6.2.0 | Apply 6.2.0.4.iFix006, available on Fix Central. |
| IBM Sterling Connect:Direct for UNIX | 6.1.0 | Apply 6.1.0.4.iFix056, available on Fix Central. |
| IBM Sterling Connect:Direct for UNIX | 6.0.0 | Apply 6.0.0.2.iFix135, available on Fix Central. |
| IBM Sterling Connect:Direct for UNIX | 4.3.0 | Apply 4.3.0.1.iFix101, available on Fix Central. |
Workarounds and Mitigations
None
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
67.9%