Lucene search

K
ibmIBME8369E4F0706AD67E1935A667DD2E6F656DC66DBF75209AA618BDB625E1D75DA
HistoryAug 12, 2020 - 1:12 a.m.

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-12406)

2020-08-1201:12:43
www.ibm.com
6

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

Summary

IBM WebSphere Application Server Liberty is vulnerable to an Apache CXF denial of service which affects IBM Spectrum Protect Operations Center and Client Management Service.

Vulnerability Details

CVEID:CVE-2019-12406
**DESCRIPTION:**Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a given message. By sending a specially-crafted message containing an overly large number of message attachments, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/170974 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Spectrum Protect Operations Center 8.1.0.000-8.1.9.xxx
7.1.0.000-7.1.10.xxx
IBM Spectrum Protect Client Management Service (CMS) 8.1.0.000-8.1.9.xxx
7.1.0.000-7.1.10.xxx

Remediation/Fixes

Spectrum Protect Operations Center Release First Fixing VRM Level Platform Link to Fix
8.1 8.1.10.000 AIX
Linux
Windows <http://www.ibm.com/support/pages/node/6229104&gt;
7.1 7.1.11.000 AIX
Linux
Windows <https://www.ibm.com/support/pages/node/6256682&gt;
Spectrum Protect Client Management Service Release First Fixing VRM Level Platform Link to Fix
8.1 8.1.10.000 Linux
Windows <https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/cms/v8r1/&gt;
7.1 7.1.11.000 Linux
Windows <https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/cms/v7r1/&gt;

Workarounds and Mitigations

None

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

Related for E8369E4F0706AD67E1935A667DD2E6F656DC66DBF75209AA618BDB625E1D75DA