775 matches found
Security Bulletin: A vulnerability in net-snmp affects IBM DataPower Gateways (CVE-2015-5621)
Summary IBM DataPower gateways has addressed a vulnerability in SNMP parsing routines that could cause the SNMP daemon to crash or execute arbitrary code. Vulnerability Details CVEID: CVE-2015-5621 DESCRIPTION: Net-SNMP is vulnerable to a denial of service, caused by incompletely parsed varBind...
Security Bulletin: A vulnerability in XML processing affects IBM DataPower Gateways (CVE-2015-1819)
Summary IBM DataPower Gateways has addressed a vulnerability in parsing certain XML files that could cause a denial of service. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreade...
Security Bulletin: A vulnerability in the GSKit component of IBM DataPower Gateways (CVE-2016-0201)
Summary IBM DataPower Gateways uses GSKit in certain modules - namely MQ, ISAM/TAM, JMS. A vulnerability has been addressed in the GSKit component of IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive...
Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM DataPower Gateways (CVE-2015-7575)
Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...
Security Bulletin: A security vulnerability exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance
Summary There is a vulnerability in IBM Java Runtime Version 7 that is used by WebSphere DataPower XC10 Appliance Versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in October 2015. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified...
Security Bulletin: Sensitive data lingers in memory on the WebSphere DataPower XC10 Appliance
Summary Sensitive data lingers in memory allowing access by an administrator of the WebSphere DataPower XC10 Appliance. This is addressed in the interim fix. Vulnerability Details CVEID: CVE-2015-7418 DESCRIPTION: The IBM WebSphere DataPower XC10 Appliance allows some sensitive data to linger in...
Security Bulletin: Vulnerability in Apache Commons affects WebSphere DataPower XC10 Appliance (CVE-2015-7450)
Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the syste...
Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance
Summary There are multiple vulnerabilities in IBM Java Runtime Version 7 that is used by WebSphere DataPower XC10 Appliance Versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified...
Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1792)
Summary SSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when processing an ECParameters...
Security Bulletin: Vulnerabilities in unzip affect IBM DataPower Gateways (CVE-2014-8141)
Summary IBM DataPower Gateways has addressed a vulnerability in 'unzip utility' that it uses to list, test, or extract files from a zip archive. Vulnerability Details CVEID: CVE-2014-8141 DESCRIPTION: Info-ZIP UnZip is vulnerable to a buffer overflow, caused by improper bounds checking by the...
Security Bulletin: Padding Oracle Protection in IBM DataPower Gateways GatewayScript modules (CVE-2015-7412)
Summary IBM DataPower Gateways has addressed a Padding Oracle Protection vulnerability in GatewayScript decryption. Vulnerability Details CVEID: CVE-2015-7412 DESCRIPTION: IBM DataPower Gateways GatewayScript modules may be vulnerable to Padding Oracle attacks in some scenarios, which could allow...
Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Datapower Gateways (CVE-2015-4000)
Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Datapower Gateways. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...
Security Bulletin: Vulnerability in RC4 stream cipher affects WebSphere DataPower XC10 Appliance V2.1 (CVE-2015-2808)
Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects WebSphere DataPower XC10 Appliance Version 2.1. WebSphere DataPower XC10 Appliance Version 2.5 is not affected. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere DataPower XC10 Appliance: CVE-2015-0138, CVE-2014-6593, CVE-2015-0410
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition. These vulnerabilities affect WebSphere DataPower XC10 versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK:...
Security Bulletin: WebSphere DataPower Appliance V2.1 Validation Vulnerability CVE-2015-1893
Summary A vulnerability in IBM® WebSphere DataPower XC10 Appliance V2.1 has confidentiality and integrity impact. Vulnerability Details CVE-ID: CVE-2015-1893 DESCRIPTION: IBM® WebSphere DataPower XC10 Appliance could allow a remote attacker to hijack a valid user's session, caused by improper...
Security Bulletin: GNU C library (glibc) vulnerability affects WebSphere DataPower XC10 Appliance (CVE-2015-0235)
Summary GNU C library glibc vulnerability that has been referred to as GHOST affects WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID:CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafte...
Security Bulletin: GNU C library (glibc) vulnerability affect IBM DataPower Gateway appliances (CVE-2014-6040)
Summary GNU C library glibc vulnerability in iconv function affects IBM DataPower Gateway appliances. Vulnerability Details CVEID: CVE-2014-6040 DESCRIPTION: The GNU C Library glibc is vulnerable to a denial of service, caused by the improper validation of input by the iconv function when...
Security Bulletin: GNU C library (glibc) vulnerability affects IBM DataPower Gateway appliances (CVE-2015-0235)
Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM DataPower Gateway appliances. Vulnerability Details CVEID:CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafted,...
Security Bulletin: Two vulnerabilities in IBM® SDK Java™ Technology Edition affect WebSphere DataPower XC10 Appliance:CVE-2014-3566,CVE-2014-6457
Summary Two vulnerabilities are present in IBM® SDK Java™ Technology Edition as embedded in the WebSphere DataPower XC10 Appliance. This issue was disclosed as part of the IBM SDK Java updates in October 2014. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote...
Security Bulletin: Vulnerability in SSLv3 affects IBM Workflow for Bluemix beta (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 was enabled by default in IBM Workflow for Bluemix beta. Vulnerability Details CVE ID: CVE-2014-3566 DESCRIPTION: IBM Workflow for Bluemix beta could allow a...