Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296)

Summary A fix is available for IBM Storwize V7000 Unified, for the security vulnerabilities in Network Time Protocol NTP being used. Vulnerability Details Network Time Protocol NTP is used in IBM Storwize V7000 Unified for synchronizing time. CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protoco...

Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2014-0227)

Summary Apache Tomcat unauthorized access vulnerability Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2014-0227 DESCRIPTION: Apache Tomcat is vulnerab...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2015-0240)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that an attacker could execute arbitrary code on the system by exploiting a vulnerability in Samba Vulnerability Details CVEID: CVE-2015-0240 DESCRIPTION: Samba is used in IBM Storwize V7000 Unified to enable file...

Security Bulletin: OpenSSL security vulnerabilities in IBM Storwize V7000 Unified (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206)

Summary A fix is available for IBM Storwize V7000 Unified, for the OpenSSL security vulnerabilities found in January 2015. Vulnerability Details OpenSSL is used in IBM Storwize V7000 Unified for providing communication security by encrypting data being transmitted. CVEID: CVE-2014-3570 DESCRIPTIO...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM Storwize V7000 Unified (CVE-2014-6593, CVE-2015-0410)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM Storwize V7000 Unified. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2014-6593 DESCRIPTION: A flaw in the TLS...

Security Bulletin: Open Source GNU glibc vulnerabilities on IBM Storwize V7000 Unified (CVE-2014-7817, CVE-2014-9087)

Summary IBM Storwize V7000 Unified is shipped with GNU glibc, for which fixes are available for two security vulnerabilities. Vulnerability Details CVEID: CVE-2014-7817 DESCRIPTION: GNU C Library glibc could allow a local attacker to execute arbitrary commands on the system. An attacker could...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM System Storage Storwize V7000 Unified (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM System Storage Storwize V7000 Unified Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM System Storage Storwize V7000 Unified (CVE-2014-6512 and CVE-2014-6457)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM System Storage Storwize V7000 Unified. This issue was disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVEID: CVE-2014-6512 DESCRIPTION: A...

Security Bulletin: Vulnerability in IBM Java SDK affect IBM System Storage Storwize V7000 Unified (CVE-2014-4263)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM System Storage Storwize V7000 Unified. This issue was disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An...

Security Bulletin: Vulnerability in SSLv3 affects IBM Storwize V7000 Unified (CVE-2014-3566)

Summary There are security vulnerabilities in SSLv3 that is shipped with IBM Storwize V7000 Unified. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote use...

Security Bulletin: Vulnerabilities in Bash affect certain IBM N Series products (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM N Series products using certain versions of the following: Data...

Security Bulletin: OpenSSL security vulnerabilities in IBM Storwize V7000 Unified (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511)

Summary There are security vulnerabilities related to OpenSSL in IBM Storwize V7000 Unified products. Vulnerability Details OpenSSL is used in IBM Storwize V7000 Unified for providing communication security by encrypting data being transmitted. CVEID: CVE-2014-3505 DESCRIPTION: OpenSSL is...

Security Bulletin: Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified (CVE-2014-1562, CVE-2014-1567)

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions 1.3.0.0 to 1.4.3.4 and 1.5.0.0 to 1.5.0.2 of IBM Storwize V7000 Unified Vulnerability Details IBM Storwize V7000 Unified is shipped with Mozilla Firefox, although Firefox is not used during...

Security Bulletin: Vulnerabilities in Bash affect IBM System Storage Storwize V7000 Unified (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. These vulnerabilities have been referred to as “Bash Bug” or “Shellshock”. Bash is used by IBM System Storage Storwize V7000 Unified. Vulnerability Details The following vulnerabilities are only exploitable by users who already ha...

Security Bulletin: Administrator password can be reset without authentication on the IBM V7000 Unified (CVE-2014-4811)

Summary The administrator superuser password can be reset to a default value without requiring prior authentication Vulnerability Details CVEID: CVE-2014-4811 DESCRIPTION: An unauthorized user with network access to a system's administrative IP Internet Protocol address may be able to reset the...

Security Bulletin: Vulnerability in Apache Struts affects IBM System Storage Storwize V7000 Unified (CVE-2014-0094)

Summary There is a ParametersInterceptor security bypass vulnerability in Apache Struts that is used by IBM System Storage Storwize V7000 Unified. Vulnerability Details CVEID: CVE-2014-0094 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by an erro...

Security Bulletin: Apache Tomcat vulnerabilities on IBM System Storage Storwize V7000 Unified (CVE-2013-4286 CVE-2013-4332 CVE-2014-0075 CVE-2014-0099)

Summary Apache Tomcat DoS and unauthorized access vulnerabilities Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2013-4286 DESCRIPTION: Apache Tomcat i...

Security Bulletin: Denial of service for accessing data using HTTP protocol on IBM Storwize V7000 Unified (CVE-2007-6750)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue of Denial of service for accessing data using HTTP protocol. Vulnerability Details CVEID: CVE-2007-6750 DESCRIPTION: IBM Storwize V7000 Unified supports data access using HTTP protocol. Apache HTTP Server is...

Security Bulletin: Password provided for executing chkauth is logged in audit log on IBM Storwize V7000 Unified (CVE-2014-3077)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that Password provided for executing chkauth is logged in audit log Vulnerability Details CVEID: CVE-2014-3077 DESCRIPTION: Under some circumstances, user details appear in the system audit log. An attacker could...

Security Bulletin: IBM Storwize V7000 Unified security vulnerabilities related to Mozilla Firefox (CVE-2014-1518, CVE-2014-1523, CVE-2014-1524, CVE-2014-1529, CVE-2014-1530, CVE-2014-1531, CVE-2014-1532, CVE-2014-1533, CVE-2014-1538, CVE-2014-1541)

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions of IBM Storwize V7000 Unified. Vulnerability Details CVEID: CVE-2014-1518 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 CVE-2014-1533 CVE-2014-1538...