7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.2%
POWER9/POWER8: In response to a recently reported DHCP client security vulnerability, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-5732.
DESCRIPTION: ISC DHCP is vulnerable to a denial of service, caused by a buffer overflow in dhclient. By sending a specially crafted response, a remote attacker could overflow a buffer and possibly execute arbitrary code on the system or cause the server to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139613> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
The firmware update can be obtained from FixCentral by specifying the Product and fix level as specified in this Remediation section.
Firmware releases FW910 is affected.
Firmware releases FW810, FW820, FW830, FW840, FW860 are affected.
Customers with the products below, install FW910.10
IBM Power System S922 (9009-22A)
IBM Power System H922 (9223-22H)
IBM Power System S914 (9009-41A)
IBM Power System S924 (9009-42A)
IBM Power System H924 (9223-42H)
IBM Power System L922 (9008-22L)
Customers with the products below, install FW860.60
IBM Power System S812(8284-21A)
IBM Power System S822(8284-22A)
IBM Power System S814(8286-41A)
IBM Power System S824(8286-42A)
IBM Power System S812L(8247-21L)
IBM Power System S822L(8247-22L)
IBM Power System S824L(8247-42L)
IBM Power System E850(8408-E8E)
IBM Power System E850C(8408-44E)
IBM Power System E870(9119-MME)
IBM Power System E870C(9080-MME)
IBM Power System E880(9119-MHE)
IBM Power System E880C(9080-MHE)
IBM Power System S812L(5148-21L)
IBM Power System S822L(5148-22L)
Static IP can be used for the service processor network configurations instead of dynamic(DHCP) IP to avoid the problem.
CPE | Name | Operator | Version |
---|---|---|---|
power system ac922 server (8335-gtc) | eq | any | |
ibm power systems | eq | any |
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.2%