Service Assistant GUI Elevation of Privilege Vulnerability in Multiple IBM Products

The IBM Storwize V7000, Storwize V5000, and FlashSystem V9000 are products of IBM Corporation in the U.S.A. The IBM Storwize V7000 and Storwize V5000 are virtualized storage systems.The FlashSystem V9000 is an all-flash enterprise storage The Service Assistant GUI is one of the graphical user...

IBM Storwize 1.5.x / 1.6.x < 1.6.2.0 RC4 Initial Keystream Bias Vulnerability (CVE-2017-1375)

According to its self-reported version number, the IBM Storwize server running on the remote host uses a weak encryption algorithm that contains a flaw in the initial keystream generation that introduces several types of biases. These can be used in a cryptanalysis attack to disclose sensitive...

IBM Storwize V7000 Unified Information Disclosure Vulnerability

IBM System Storage Storwize V7000 Unified is an enhanced virtualized storage system designed for small and medium-sized businesses in the Storwize family from IBM America. The system supports data migration, data sharing and data backup. An information disclosure vulnerability exists in IBM Syste...

CVE-2017-1375

IBM System Storage Storwize V7000 Unified V7000U 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126868...

CVE-2017-1375

IBM System Storage Storwize V7000 Unified V7000U 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126868...

CVE-2017-1375

CVE-2017-1375 affects IBM Storwize V7000 Unified (V7000U) 1.5 to 1.6, where use of weaker cryptographic algorithms could allow an attacker to decrypt highly sensitive information. IBM’s bulletin notes that a fix is available in v1.6.2.0 (1.5 is EOS); apply the upgrade to mitigate. The issue is do...

IBM Storwize for Lenovo initialization USB drives contain malware - Lenovo Support US

No description provided...

IBM Storwize for Lenovo initialization USB drives contain malware - us

Lenovo Security Advisory: LEN-14957 Potential Impact: Malware infection on system used to launch initialization tool Severity: Medium Summary Description: Some USB flash drives containing the initialization tool shipped with the IBM Storwize for Lenovo V3500, V3700 and V5000 Gen 1 storage systems...

IBM: Destroy USBs Infected with Malware Dropper

USB drives shipped with some IBM’s Storwize storage products are infected with malware, and the tech giant advises customers destroy the devices. IBM would not comment on the source of the infection or where in the supply chain the interdiction happened, and instead referred Threatpost to an...

IBM Storwize SSL/TLS RC4 Stream Cipher Key Invariance (Bar Mitzvah)

According to its self-reported version number, the IBM Storwize server running on the remote host is affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A...

IBM Storwize V7000 Unified ACL Security Bypass

The remote IBM Storwize device is affected by an ACL security bypass vulnerability due to a race condition in the Active Cloud Engine ACE component caused by an error in NFS packet retransmission in response to noisy or slow responding networks. An authenticated, remote attacker can exploit this ...

IBM Storwize V7000 Unified 1.3.x < 1.4.3.5 / 1.5.x < 1.5.0.4 Multiple Vulnerabilities (Shellshock)

The remote IBM Storwize V7000 Unified device is running version 1.3.x prior to 1.4.3.5 or 1.5.x prior to 1.5.0.4. It is, therefore, affected by the following vulnerabilities : - A command injection vulnerability exists in GNU Bash known as Shellshock. The vulnerability is due to the processing of...

IBM Storwize 1.3.x < 1.4.3.4 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities

The remote IBM Storwize device is running a version that is 1.3.x prior to 1.4.3.4 or 1.5.x prior to 1.5.0.2. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists due to a flaw in the bundled version of Apache HTTP Server. A remote attacker can explo...

IBM Storwize Detection

Binary data ibmstorwizedetect.nbin...

Default Password (passw0rd) for 'superuser' Account

The account 'superuser' on the remote host has the password 'passw0rd'. An attacker can leverage this issue to gain administrative access to the affected system. Note that IBM Storwize devices are known to use these credentials to provide administrative access to the device. %NASLMINLEVEL 70300 C...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

Default credentials

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified (V7000U) 1.3.x and 1.4.x before 1.4.3.4 are affected by CVE-2014-3077, where the chkauth password is stored in the audit log. This enables a local attacker to read the log and obtain sensitive information. IBM security bulletins (CVE-2014-3077) ...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

CVE-2014-4811

IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address...