Security Bulletin: Vulnerability in system log on IBM DataPower Gateways WebGUI (CVE-2017-1591)

Summary A potential cross-site scripting vulnerability exists in the DataPower system log. IBM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1591 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to cross-site scripting. This vulnerability allows users to emb...

Security Bulletin: Vulnerability in XDR affects IBM DataPower Gateways (CVE-2017-8804)

Summary A potential Denial of Service vulnerability exists in XDR. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-8804 DESCRIPTION: glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdrbytes and...

Security Bulletin: Vulnerability in Node.js affects IBM DataPower Gateways (CVE-2017-11499)

Summary Potential Denial of Service in Node.js. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-11499 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a flaw related to constant HashTable seeds. A remote attacker could exploit thi...

Security Bulletin: A vulnerability in OpenSSL affects IBM DataPower Gateways (CVE-2016-2183)

Summary A vulnerability in the SSL/TLS protocol affects the ISAM Access Manager client and JMS. IBM DataPower Gateways has fully addressed the applicable CVE in version 7.5.2, and in earlier releases it was addressed with a combination of a code fix and a workaround. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in SSH affects IBM DataPower Gateways (CVE-2016-8858)

Summary An SSH vulnerability was disclosed by the OpenSSH Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-8858 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the kexinputkexinit function. By sending speciall...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6304 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By repeatedly requesting renegotiation, a...

Security Bulletin: A busybox vulnerability affects IBM DataPower Gateways (CVE-2014-4607)

Summary A buffer overflow vulnerability affects IBM DataPower Gateways. IBM DataPower Gateways has addressed the applicable CVE Vulnerability Details CVEID: CVE-2014-4607 DESCRIPTION: Oberhumer LZO could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflo...

Security Bulletin: Vulnerabilities in node.js processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in Node.js V8 processing that could cause a denial of service or remote code execution. Vulnerability Details CVEID: CVE-2016-1669 DESCRIPTION: Node.js V8 processing is vulnerable to a buffer overflow, caused by an error in V8. By...

Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in processing certain XML files that could cause a denial of service or obtain sensitive information. Vulnerability Details CVEID: CVE-2016-4448 DESCRIPTION: libxml2 could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM DataPower Gateways (CVE-2015-7547)

Summary A GNU C library glibc stack-based buffer overflow in getaddrinfo vulnerability affects IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2015-7547 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the nssdns backe...

Security Bulletin: A vulnerability in XML processing affects IBM DataPower Gateways (CVE-2015-1819)

Summary IBM DataPower Gateways has addressed a vulnerability in parsing certain XML files that could cause a denial of service. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreade...

Security Bulletin: A vulnerability in the GSKit component of IBM DataPower Gateways (CVE-2016-0201)

Summary IBM DataPower Gateways uses GSKit in certain modules - namely MQ, ISAM/TAM, JMS. A vulnerability has been addressed in the GSKit component of IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM DataPower Gateways (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...

Security Bulletin: Vulnerabilities in unzip affect IBM DataPower Gateways (CVE-2014-8141)

Summary IBM DataPower Gateways has addressed a vulnerability in 'unzip utility' that it uses to list, test, or extract files from a zip archive. Vulnerability Details CVEID: CVE-2014-8141 DESCRIPTION: Info-ZIP UnZip is vulnerable to a buffer overflow, caused by improper bounds checking by the...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1792)

Summary SSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when processing an ECParameters...

Security Bulletin: Padding Oracle Protection in IBM DataPower Gateways GatewayScript modules (CVE-2015-7412)

Summary IBM DataPower Gateways has addressed a Padding Oracle Protection vulnerability in GatewayScript decryption. Vulnerability Details CVEID: CVE-2015-7412 DESCRIPTION: IBM DataPower Gateways GatewayScript modules may be vulnerable to Padding Oracle attacks in some scenarios, which could allow...

Sierra Wireless Patches Critical Vulns in Range of Wireless Routers

Sierra Wireless has patched two critical vulnerabilities for its range of wireless gateways that would leave the enterprise devices helpless to an array of remote threats, including the charms of the Reaper IoT botnet. The more critical of the two with a 9.4 CVSSv3 Temp Score is a...

All Aliases Have Failed

Challenge A Tenant's Backup Job or Backup Copy Job targeting a Cloud Repository fails with the following message: Target gate has rejected connection. Unable to establish target connection. All aliases have failed. The wording of the error might differ, but the root error "All Aliases Have Failed...

Web Application Firewalls: The Definitive Primer

Firewalls have traditionally been focused on network layer traffic. As attacks have evolved, however, they have climbed the ladder of the Open Systems Interconnection OSI model. Web Application Firewalls WAFs have developed as a result, not only to track network traffic but also to understand...

CVE-2017-17296

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...