Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM) Storage Manager Install Anywhere (SMIA) configuration tool

Summary OpenSSL vulnerabilities were disclosed on January 26, 2017 by the OpenSSL Project. OpenSSL was used by IBM FSM SMIA configuration tool commonly known as Network Advisor. This bulletin addresses the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is...

Security Bulletin: IBM b-type Network/Storage switches is affected by Open Source OpenSSL Vulnerabilities (OpenSSL and Node.JS consumers).

Summary IBM b-type Network/Storage switches has addressed the following vulnerabilities CVE-2017-3730, CVE-2017-3731, CVE-2017-3732, CVE-2016-7055. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. By sendin...

Security Bulletin: Open Source OpenSSL Vulnerabilities in IBM Network Advisor

Summary Open Source OpenSSL Vulnerabilities in IBM Network Advisor CVE-2017-3733. Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-3733 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error during a renegotiate handshake when the original handshake did not...

Security Bulletin: Open Source OpenSSL Vulnerabilities affect IBM Network Advisor

Summary Open Source OpenSSL Vulnerabilities affect IBM Network Advisor CVE-2016-7053, CVE-2016-7054, CVE-2016-7055 Vulnerability Details CVEID: CVE-2016-7053 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference when processing invalid encodings in the...

Security Bulletin: Directory Traversal vulnerabilities impact IBM Network Advisor.

Summary Multiple Directory Traversal vulnerabilities affect IBM b-type SAN Network Advisor CVE-2016-8204, CVE-2016-8205,CVE-2016-8206, CVE-2016-8207. Vulnerability Details CVEID: CVE-2016-8204 DESCRIPTION: Brocade Network Advisor could allow a remote attacker to traverse directories on the system...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Network Advisor (CVE-2016-3425, CVE-2016-3427, CVE-2016-0695).

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology used in IBM Network Advisor. Vulnerability Details CVEID: CVE-2016-3427 DESCRIPTION: An unspecified vulnerability related to the JMX component has complete confidentiality impact, complete integrity impact, and complete...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (or if just using Runtime state IBM Java Runtime) affect IBM Network Advisor (CVE-2015-4748, CVE-2016-2613, CVE-2016-2601, CVE-2016-4749, CVE-2016-2625)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Network Advisor. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-4748 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM b-type SAN Network Advisor (CVE-2016-0483, CVE-2016-0466, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Network Advisor. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2016-0483 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Network Advisor.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM b-type SAN Network Advisor. These issues were disclosed as part of the IBM Java SDK updates for October 2015 CVE-2015-4872, CVE-2015-4911, CVE-2015-4893, CVE-2015-4803. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Network Advisor (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Network Advisor. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in Brocade Network Advisor affect IBM PureApplication System.

Summary Brocade Network Advisor is used by IBM PureApplication System. IBM PureApplication System has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-8204 DESCRIPTION: Brocade Network Advisor could allow a remote attacker to traverse directories on the system. An attacker cou...

Access Control Vulnerability in Hitachi Infrastructure Analytics Advisor

Overview An Access Control Vulnerability was found in Hitachi Infrastructure Analytics Advisor. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate...

Design/Logic Flaw

Integrated Management Module II IMM2 on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data FFDC. IBM X-Force ID: 91149...

CVE-2014-0882

Integrated Management Module II IMM2 on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data FFDC. IBM X-Force ID: 91149...

CVE-2017-8013

EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password...

Hardcoded credentials

EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password...

CVE-2017-8013

EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password...

CVE-2017-8013

CVE-2017-8013 affects EMC Data Protection Advisor 6.3.x (before patch 67) and 6.4.x (before patch 130). Root cause: undocumented accounts with hard-coded passwords (Apollo System Test, emc.dpa.agent.logon, emc.dpa.metrics.logon) enabling access via REST APIs and potentially administrative privile...

CVE-2017-8013

EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password...

EMC Data Protection Advisor < 6.4.110 Database Hardcoded Password Vulnerability

According to its self-reported version number, the EMC Data Protection Advisor running on the remote host is 6.3.x prior to 6.3 patch 159 or 6.4.x prior to 6.4 patch 110. It is, therefore, affected by a default credential vulnerability due to hardcoded password with the appolosuperuser database...