Security Bulletin: Apache Tomcat vulnerabilities on IBM System Storage Storwize V7000 Unified (CVE-2013-4286 CVE-2013-4332 CVE-2014-0075 CVE-2014-0099)

Summary Apache Tomcat DoS and unauthorized access vulnerabilities Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2013-4286 DESCRIPTION: Apache Tomcat i...

Security Bulletin: IBM Storwize V7000 Unified security vulnerabilities related to Mozilla Firefox (CVE-2014-1555, CVE-2014-1556, CVE-2014-1557)

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions of IBM Storwize V7000 Unified Vulnerability Details CVEID: CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 DESCRIPTION: IBM Storwize V7000 Unified is shipped with Mozilla Firefox, although Firefox i...

Security Bulletin: Password provided for executing chkauth is logged in audit log on IBM Storwize V7000 Unified (CVE-2014-3077)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that Password provided for executing chkauth is logged in audit log Vulnerability Details CVEID: CVE-2014-3077 DESCRIPTION: Under some circumstances, user details appear in the system audit log. An attacker could...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3493)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that an attacker could crash applications by exploiting a vulnerability in Samba Vulnerability Details CVEID: CVE-2014-3493 DESCRIPTION: Samba is used in IBM Storwize V7000 Unified to enable file management and...

Security Bulletin: IBM Storwize V7000 Unified security vulnerabilities related to Mozilla Firefox (CVE-2014-1518, CVE-2014-1523, CVE-2014-1524, CVE-2014-1529, CVE-2014-1530, CVE-2014-1531, CVE-2014-1532, CVE-2014-1533, CVE-2014-1538, CVE-2014-1541)

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions of IBM Storwize V7000 Unified. Vulnerability Details CVEID: CVE-2014-1518 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 CVE-2014-1533 CVE-2014-1538...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-0178)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that an attacker could obtain sensitive information by exploiting a vulnerability in Samba Vulnerability Details CVE-2014-0178 DESCRIPTION: Samba is used in IBM Storwize V7000 Unified to enable file management and...

Security Bulletin: Apache Tomcat security vulnerability issues on IBM Storwize V7000 Unified (CVE-2014-0075, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119)

Summary IBM Storwize V7000 Unified is shipped with Apache Tomcat, for which fixes are available for four security vulnerabilities. Vulnerability Details CVEID: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 DESCRIPTION: Apache Tomcat is used in IBM Storwize V7000 Unified for providing...

Security Bulletin: GUI DoS vulnerability in IBM Storwize V7000 Unified (CVE-2014-0050)

Summary Block module GUI interface can be disrupted by exploitation of Apache Tomcat vulnerability Vulnerability Details CVEID: CVE-2014-0050 DESCRIPTION: This bulletin relates to vulnerabilities in the Apache Tomcat component in the block module which, if successfully exploited, could stop the...

Security Bulletin: Privileged access can be obtained from IBM Service account on IBM Storwize V7000 Unified (CVE-2014-3043)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that privileged access can be obtained from IBM Service account. Vulnerability Details CVEID: CVE-2014-3043 DESCRIPTION: The IBM Storwize V7000 Unified service account can be used to obtain unauthorized privileges o...

Security Bulletin: While changing password of administrative user, the supplied password is exposed in shell command history on IBM Storwize V7000 Unified (CVE-2014-3045)

Summary A fix is available for IBM Storwize V7000 Unified for the security issue where the password is exposed in the shell command history while changing the password of administrative user. Vulnerability Details CVEID: CVE-2014-3045 DESCRIPTION: One of the purposes of chuser command is to modif...

Security Bulletin: Java vulnerability issue on IBM Storwize V7000 Unified system (CVE-2014-0411)

Summary IBM Storwize V7000 Unified system is shipped with Java, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2014-0411 DESCRIPTION: IBM Storwize V7000 Unified system is shipped with Java. Java is used in the V7000 Unified for implementing the system...

Security Bulletin: OpenSSL vulnerability in IBM Storwize V7000 Unified (CVE-2014-0224)

Summary Security vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2014-0224 DESCRIPTION: SSL/TLS MITM vulnerability An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a...

Security Bulletin: Incorrect access control list (ACL) might occur in case of a network retransmission, when Active Cloud Engine (ACE) is being used on IBM Storwize V7000 Unified system (CVE-2014-0875)

Summary Incorrect access control list ACL might occur in case of a network retransmission, when Active Cloud Engine ACE is being used. Vulnerability Details CVEID: CVE-2014-0875 DESCRIPTION: Active Cloud Engine ACE component of IBM V7000 Unified uses NFS client operations for data transmission. A...

Security Bulletin: OpenSSL security vulnerability issues on IBM Storwize V7000 Unified system (CVE-2013-4353, CVE-2013-6449, CVE-2013-6450)

Summary For the three security issues with openssl that could result in denial of service, a fix is available for IBM Storwize V7000 Unified system. Vulnerability Details CVEID: CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 DESCRIPTION: OpenSSL is used in IBM Storwize V7000 Unified system for providi...

Security Bulletin: Apache Tomcat security vulnerability issues on IBM Storwize V7000 Unified system (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590)

Summary IBM Storwize V7000 Unified system is shipped with Apache Tomcat, for which fixes are available for four security vulnerabilities. Vulnerability Details CVEID: CVE-2013-4286 CVE-2014-0033 CVE-2013-4322 CVE-2013-4590 DESCRIPTION: Apache Tomcat is used in IBM Storwize V7000 Unified system fo...

Security Bulletin: Mozilla firefox vulnerability issues on IBM Storwize V7000 Unified system (CVE-2014-1493, CVE-2014-1497, CVE-2014-1505, CVE-2014-1508, CVE-2014-1509, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Summary IBM Storwize V7000 Unified system is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2014-1493 CVE-2014-1497 CVE-2014-1505 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513...

Security Bulletin: Hardware failure diagnostic information can include customer data fragments in IBM System Storage Storwize V7000 Unified (CVE-2013-6737)

Summary Hardware failure diagnostics for a 1691 error include customer data fragments that may be copied from the system by an authorized user who might not otherwise have access to that data. Vulnerability Details CVEID: CVE-2013-6737 DESCRIPTION: In the event of a rare hardware fault error code...

Security Bulletin: Mozilla firefox vulnerability issues on IBM Storwize V7000 Unified system (CVE-2013-5609, CVE-2013-5610, CVE-2013-5611, CVE-2013-5612, CVE-2013-5613, CVE-2013-5614, CVE-2013-5615, CVE-2013-5616, CVE-2013-5618, CVE-2013-5619, CVE-2013-6

Summary IBM Storwize V7000 Unified system is shipped with Mozilla firefox, for which fixes are available for security vulnerabilities. Vulnerability Details CVEID: CVE-2013-5609 CVE-2013-5610 CVE-2013-5611 CVE-2013-5612 CVE-2013-5613 CVE-2013-5614 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618...

Security Bulletin: Mozilla firefox vulnerability issue on IBM Storwize V7000 Unified system (CVE-2013-5607)

Summary IBM Storwize V7000 Unified system is shipped with Mozilla firefox, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2013-5607 DESCRIPTION: IBM Storwize V7000 Unified system is shipped with Mozilla firefox. A fix is available for the security...

Security Bulletin: IBM Storwize V7000 Unified systems are affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...