Lucene search

K
ibmIBME78F8769E3C6FC94835A03FDC3E9DB0C47396C80E02CF8741F425B3CD4CCF404
HistoryFeb 27, 2020 - 6:58 p.m.

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerabilities in TCP (CVE-2019-11477, CVE-2019-11478, CVE-2019-11479)

2020-02-2718:58:53
www.ibm.com
13

0.974 High

EPSS

Percentile

99.9%

Summary

The following vulnerabilities in TCP have been addressed by IBM Integrated Management Module II (IMM2).

Vulnerability Details

CVEID:CVE-2019-11478
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by an issue with fragmenting the TCP retransmission queue when processing TCP Selective Acknowledgement (SACK) capabilities. By sending specially-crafted SACKs requests, a remote attacker could exploit this vulnerability to cause an excess of system resource usage.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162664 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2019-11477
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by an integer overflow when processing TCP Selective Acknowledgement (SACK) capabilities. By sending specially-crafted SACKs requests, a remote attacker could exploit this vulnerability to cause a kernel panic condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162662 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2019-11479
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by a flaw when processing minimum segment size (MSS). By sending specially-crafted MSS traffic, a remote attacker could exploit this vulnerability to cause excess usage of system resources.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162665 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Integrated Management Module II (IMM2) for System x and Flex 1AOO
IBM Integrated Management Module II (IMM2) for BladeCenter 1AOO

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Affected Product(s) Version(s)

IBM Integrated Management Module II (IMM2) for System x and Flex

(ibm_fw_imm2_1aoo90b-7.40_anyos_noarch)

| 1AOO90B-7.40

IBM Integrated Management Module II (IMM2) for BladeCenter

(ibm_fw_imm2_1aoo90b-7.40-bc_anyos_noarch)

| 1AOO90B-7.40-bc

Workarounds and Mitigations

None