Security Bulletin: Vulnerabilities in DHCP affect Power Hardware Management Console (‪CVE-2015-8605 and CVE-2016-2774‬‬)

Summary DHCP is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-8605 DESCRIPTION: ISC DHCP is vulnerable to a denial of service, caused by the failure to properly check the UDP payload length. By sending a specially craft...

Security Bulletin: Vulnerabilities in glibc affect Power Hardware Management Console (CVE-2014-8121)

Summary glibc is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-8121 DESCRIPTION: GNU C Library glibc is vulnerable to a denial of service, caused by the failure to properly check if a file is open by DBLOOKUP in...

Security Bulletin: Vulnerabilities in bind affect Power Hardware Management Console (CVE-2016-1285, CVE-2016-1286)

Summary bind is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2016-1285 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by the improper handling of control channel input. By sending a specially crafted...

Security Bulletin: Vulnerabilities in OpenSSL affect Power Hardware Management Console (CVE-2016-2180, CVE-2016-2182, CVE-2016-6306)

Summary Open SSL is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2180 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read in the TSOBJprintbio function. A remote attacker could...

Security Bulletin: Multiple Vulnerabilities in NTP affect Power Hardware Management Console

Summary NTP is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-7691 DESCRIPTION: Network Time Protocol NTP is vulnerable to a denial of service, caused by an error in ntpcrypto.c. An attacker could exploit this...

Security Bulletin: Vulnerabilities in java affect Power Hardware Management Console (CVE-2016-3426 )

Summary Java is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-3426 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the JCE component could allow a remote attacker to obtain...

Security Bulletin: Power Hardware Management Console (HMC) > (CVE-2014-0883)

Problem It is possible to inject malicious code while entering user name on HMC Logon screen. This code would get activated when failed login message is displayed in HMC Event Log GUI. Resolving The Problem VULNERABILITY DETAILS: CVEID: CVE-2014-0883 DESCRIPTION: CVSS Base Score: 4.3 CVSS Tempora...

Security Bulletin: Multiple Vulnerabilities in Network Time Protocol (NTP) Affect Power Hardware Management Console (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296)

Summary There are multiple vulnerabilities in Network Time Protocol NTP Project NTP daemon ntpd that is used by Power Hardware Management Console Vulnerability Details CVE-ID: CVE-2014-9293 DESCRIPTION: Network Time Protocol NTP Project NTP daemon ntpd could provide weaker than expected security,...

Security Bulletin: Vulnerabilities in openssh affect Power Hardware Management Console (CVE-2016-0777, CVE-2016-0778)

Summary OpenSSH is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0777 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by a client information leak from using the roaming...

Security Bulletin: Power Hardware Management Console is Affected by Vulnerabilities in OpenSSL (CVE-2014-0224, CVE-2014-0221, CVE- 2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this...

Security Bulletin: Vulnerabilities in Websphere Liberty Profile (WLP) affect Power Management Console (CVE-2015-2017, CVE-2015-1927, CVE-2015-4938)

Summary Websphere liberty Profile is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-4938 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this...

Security Bulletin: Vulnerabilities in GnuTLS affect Power Hardware Management Console (CVE-2015-8313, CVE-2015-2806 )

Summary GnuTLS is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2015-2806 DESCRIPTION: An unspecified error in libtasn1 related to asn1derdecoding has an unknown impact and attack vector. CVSS Base Score: 6.8 CVSS Temporal...

Security Bulletin: Vulnerabilities in openssh affect Power Hardware Management Console (CVE-2015-5600)

Summary Opensh is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-5600 DESCRIPTION: OpenSSH could allow a local attacker to obtain sensitive information, caused by an error in the keyboard-interactive authentication...

Security Bulletin: Vulnerabilities in BIND affect Power Hardware Management Console

Summary BIND is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-9778 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by the improper handling of specific queries when using the nxdomain-redirect feature...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect Power Hardware Management Console (CVE-2014-6512, CVE-2014-3566, CVE-2014-6457, CVE-2014-6558)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 6 that is used by Power Hardware Management Console. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These were disclosed as part of the...

Security Bulletin: Vulnerabilities in OpenSSL affect Power Hardware Management Console (CVE-2016-8610 and CVE-2017-3731 )

Summary OpenSSL is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: The SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL handshake. By...

Security Bulletin: Vulnerabilities in Open SSL affect Power Hardware Management Console (CVE-2015-4000)

Summary OpenSSL is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHEEXPORT...

Security Bulletin: Vulnerability in RC4 stream cipher affects Power Hardware Management Console (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Power Hardware Management Console. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Security Bulletin: Vulnerabilities in Apache Tomcat affect Power Hardware Management Console (CVE-2016-6816, CVE-2016-6817, and CVE-2016-0762)

Summary Apache Tomcat is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6816 DESCRIPTION: Apache Tomcat is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote...

Security Bulletin: Vulnerability in OpenSSH affects Power Hardware Management Console (CVE-2015-8325)

Summary OpenSSH is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-8325 DESCRIPTION: OpenSSH could allow a local attacker to gain elevated privileges on the system, caused by an error in the dosetupenv function when the...