Security Bulletin: IBM Platform Symphony (CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116)

Summary Several security vulnerabilities have been reported against Apache Struts 2 through May 2014. IBM Platform Symphony’s GUI uses Struts 2 as a framework for Java web applications. A version of the package that is vulnerable to these issues is included in several past versions of IBM Platfor...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem 900, (CVE-2014-0227)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem 900 which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service under error scenarios. Vulnerability Details CVE-ID: CVE-2014-0227 Description: Apache Tomcat ...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem 900, (CVE-2014-0230)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem 900 which allows remote attackers to cause a denial of service under certain scenarios. Vulnerability Details CVE-ID: CVE-2014-0230 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service,...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM SONAS (CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)

Summary OpenSSL vulnerabilities were disclosed in June 2015 by the OpenSSL Project. OpenSSL is used by IBM SONAS. IBM SONAS has addressed the applicable CVEs. Vulnerability Details OpenSSL is used in IBM SONAS for providing communication security by encrypting data being transmitted. CVEID:...

Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V9000, (CVE-2014-6593 and CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 1.6.0 that is used by the IBM FlashSystem V9000. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2015-0410 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerability in OpenSSL affects IBM XIV Storage System Gen3 (CVE-2014-3570)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. OpenSSL is used by IBM XIV Storage System. IBM XIV Storage System has addressed the applicable CVE. We are unaware of any customer being affected by this issue. Vulnerability Details CVEID: CVE-2014-3570...

Security Bulletin: Apache Tomcat vulnerability affects IBM SONAS (CVE-2014-0230)

Summary Apache Tomcat denial of service vulnerability Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2014-0230 DESCRIPTION: Apache Tomcat is vulnerable...

Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V840, (CVE-2014-6593 and CVE-2015-0410))

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 1.6.0 that is used by the IBM FlashSystem V840. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2015-0410 DESCRIPTION: An unspecified...

Security Bulletin: The IBM FlashSystem V840 product model numbers AC0 and AC1 nodes are affected by vulnerabilities in Apache’s Struts library (CVE-2014-7809)

Summary Apache Struts could potentially allow a remote attacker to bypass security restrictions, caused by predictable tokens. Vulnerability Details CVEID: CVE-2014-7809 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by predictable tokens. By...

Security Bulletin: Vulnerabilities in OpenSSL affect the IBM FlashSystem V840, (CVE-2015-0205, CVE-2014-8275, CVE-2014-3569, CVE-2014-3570, and CVE-2014-3572)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. OpenSSL is used by the IBM FlashSystem V840. FlashSystem V840 has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-3569 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused b...

Security Bulletin:Vulnerabilities in Network Security Services (NSS) affect the IBM FlashSystem V840,(CVE-2014-3566)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. NSS is used by the IBM FlashSystem V840. FlashSystem V840 has addressed the applicable CVE. Vulnerability Details CVE-ID: CVE-2014-356...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Virtualization Engine TS7700 - October 2014 & January 2015

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7, IBM SDK Java Technology Edition, Version 6, and IBM SDK Java 2 Technology Edition, Version 5 that are used by IBM Virtualization Engine TS7700. These issues were disclosed as part of the IBM Java SDK updat...

Security Bulletin: Open Source GNU glibc vulnerabilities on IBM SONAS (CVE-2014-7817, CVE-2014-9087)

Summary IBM SONAS is shipped with GNU glibc, for which fixes are available for two security vulnerabilities. Vulnerability Details CVEID: CVE-2014-7817 DESCRIPTION: Provide sufficient details for someone to tell if they have the problem, but not enough detail that someone with malicious intent...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2014-6593)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM SONAS. This issue was disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2014-6593 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM SONAS (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296)

Summary A fix is available for IBM SONAS, for the security vulnerabilities in Network Time Protocol NTP being used. Vulnerability Details Network Time Protocol NTP is used in IBM SONAS for synchronizing time. CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protocol NTP Project NTP daemon ntpd coul...

Security Bulletin: OpenSSL security vulnerabilities in IBM SONAS (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206)

Summary A fix is available for IBM SONAS, for the OpenSSL security vulnerabilities found in January 2015. Vulnerability Details OpenSSL is used in IBM SONAS for providing communication security by encrypting data being transmitted. CVEID: CVE-2014-3570 DESCRIPTION: OpenSSL could provide weaker th...

Security Bulletin: Apache Tomcat vulnerability affects IBM SONAS (CVE-2014-0227)

Summary A fix is available for IBM SONAS , Apache Tomcat unauthorized access vulnerability Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2014-0227...

Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296)

Summary A fix is available for IBM Storwize V7000 Unified, for the security vulnerabilities in Network Time Protocol NTP being used. Vulnerability Details Network Time Protocol NTP is used in IBM Storwize V7000 Unified for synchronizing time. CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protoco...

Security Bulletin: NSS vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3566)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that an attacker could obtain sensitive information by exploiting a vulnerability in NSS Vulnerability Details Network Security Services NSS is a set of cryptographic software libraries. It is used in IBM Storwize...

Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2014-0227)

Summary Apache Tomcat unauthorized access vulnerability Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2014-0227 DESCRIPTION: Apache Tomcat is vulnerab...