Security Bulletin: Vulnerabiltiies in OpenSSL affect IBM SONAS (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM SONAS. IBM SONAS has addressed the applicable CVEs and included the SSL 3.0 Fallback protection TLSFALLBACKSCSV provided by OpenSS...

Security Bulletin: IBM SONAS security vulnerabilities related to Mozilla Firefox (CVE-2014-1562, CVE-2014-1567)

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions 1.3.0.0 to 1.4.3.3 of IBM SONAS. Vulnerability Details CVEID: CVE-2014-1562 CVE-2014-1567 DESCRIPTION: IBM SONAS is shipped with Mozilla Firefox, although Firefox is not used during normal use...

Security Bulletin: OpenSSL security vulnerabilities in IBM SONAS (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511)

Summary There are security vulnerabilities related to OpenSSL in IBM SONAS products. Vulnerability Details CVEID: CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 DESCRIPTION: OpenSSL is used in IBM SONAS for providing communication security by...

Security Bulletin: Vulnerabilities in Bash affect IBM SONAS (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. These vulnerabilities have been referred to as “Bash Bug” or “Shellshock”. Bash is used by IBM SONAS. Vulnerability Details The following vulnerabilities are only exploitable by users who already have authenticated access to the...

Security Bulletin: User information can appear in the system audit log on the IBM SONAS (CVE-2014-3077)

Summary A fix is available for the IBM SONAS, for the security issue that user information is displayed in system audit log Vulnerability Details CVEID: CVE-2014-3077 DESCRIPTION: Under some circumstances, user details appear in the system log. An attacker could exploit this vulnerability to gain...

Security Bulletin: Mozilla firefox vulnerability issues on IBM SONAS (CVE-2014-1518, CVE-2014-1523, CVE-2014-1524, CVE-2014-1529, CVE-2014-1530, CVE-2014-1531, CVE-2014-1532, CVE-2014-1533, CVE-2014-1538, CVE-2014-1541)

Summary SONAS is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2014-1518 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 CVE-2014-1533 CVE-2014-1538 CVE-2014-1541 DESCRIPTION: SONAS is...

Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2014-3493)

Summary A fix is available for IBM SONAS, for the security issue that an attacker could crash applications by exploiting a vulnerability in Samba Vulnerability Details CVEID: CVE-2014-3493 DESCRIPTION: Samba is used in IBM SONAS to enable file management and authentication services for Microsoft...

Security Bulletin: Denial of service for accessing data using HTTP protocol on IBM SONAS (CVE-2007-6750)

Summary A fix is available for IBM SONAS, for the security issue of Denial of service for accessing data using HTTP protocol. Vulnerability Details CVEID: CVE-2007-6750 DESCRIPTION: SONAS supports data access using HTTP protocol. Apache HTTP Server is vulnerable to a denial of service. By sending...

Security Bulletin: Mozilla firefox vulnerability issues on IBM SONAS (CVE-2014-1555, CVE-2014-1556, CVE-2014-1557)

Summary SONAS is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 DESCRIPTION: SONAS is shipped with Mozilla firefox. Fixes are available for the security vulnerabilities found with...

Security Bulletin: Apache Tomcat security vulnerability issues on IBM SONAS (CVE-2014-0075, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119)

Summary IBM SONAS is shipped with Apache Tomcat, for which fixes are available for five security vulnerabilities. Vulnerability Details CVEID: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 DESCRIPTION: Apache Tomcat is used in IBM SONAS for providing graphical user interface for the...

Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2014-0178)

Summary A fix is available for IBM SONAS, for the security issue that an attacker could obtain sensitive information by exploiting a vulnerability in Samba protocol server Vulnerability Details CVEID: CVE-2014-0178 DESCRIPTION: Samba protocol server is used in IBM SONAS to enable file management...

Security Bulletin: OpenSSL security vulnerability on IBM SONAS (CVE-2014-0224)

Summary A fix is available for IBM SONAS, for the OpenSSL security vulnerability Vulnerability Details CVEID: CVE-2014-0224 DESCRIPTION: SSL/TLS MITM vulnerability An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. Thi...

Security Bulletin: Unauthorized privileges can be obtained from IBM Service account on IBM SONAS (CVE-2014-3043)

Summary A fix is available for IBM SONAS, for the security issue that unauthorized privileges can be obtained from IBM Service account. Vulnerability Details CVEID: CVE-2014-3043 DESCRIPTION: The IBM SONAS service account can be used to obtain unauthorized privileges on a IBM SONAS system. The...

Security Bulletin: IBM SONAS Administrator password can be read by the root user from the shell command history (CVE-2014-3045)

Summary A fix is available for IBM SONAS, for the security issue that after changing password of administrative user, the password can be read by the root user from the shell command history. Vulnerability Details CVEID: CVE-2014-3045 DESCRIPTION: One of the purposes of chuser command is to modif...

Security Bulletin: OpenSSL security vulnerability issues on IBM SONAS (CVE-2013-4353, CVE-2013-6449, CVE-2013-6450)

Summary For the three security issues with openssl that could result in denial of service, a fix is available for IBM SONAS Vulnerability Details CVEID: CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 DESCRIPTION: OpenSSL is used in IBM SONAS for providing communication security by encrypting data bein...

Security Bulletin: Mozilla firefox vulnerability issues on IBM SONAS (CVE-2014-1493, CVE-2014-1497, CVE-2014-1505, CVE-2014-1508, CVE-2014-1509, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Summary SONAS is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2014-1493 CVE-2014-1497 CVE-2014-1505 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513 CVE-2014-1514 DESCRIPTION: SONAS is...

Security Bulletin: Java vulnerability issue on IBM SONAS (CVE-2014-0411)

Summary SONAS is shipped with Java, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2014-0411 DESCRIPTION: SONAS is shipped with Java. Java is required for SONAS administration, for executing SONAS specific commands on the command line, and providing...

Security Bulletin: Mozilla firefox vulnerability issues on IBM SONAS (CVE-2013-5609, CVE-2013-5610, CVE-2013-5611, CVE-2013-5612, CVE-2013-5613, CVE-2013-5614, CVE-2013-5615, CVE-2013-5616, CVE-2013-5618, CVE-2013-5619, CVE-2013-6671, CVE-2013-6672, CVE

Summary SONAS is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2013-5609 CVE-2013-5610 CVE-2013-5611 CVE-2013-5612 CVE-2013-5613 CVE-2013-5614 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-5619 CVE-2013-6671...

CVE-2014-3077: Exposure of Sensitive Information to an Unauthorized Actor

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

PT-2014-5070

Name of the Vulnerable Software and Affected Versions IBM SONAS and System Storage Storwize V7000 Unified aka V7000U versions 1.3.x through 1.4.x before 1.4.3.4 Description The issue allows local users to obtain sensitive information by reading the audit log file, where the chkauth password is...