Security Bulletin: IBM System x Integrated Management Module (IMM) Lighttpd W (CVE-2011-4362, CVE-2010-0295, CVE-2008-4360, CVE-2008-4359, CVE-20084298, CVE-2008-1531)

Summary Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Content Vulnerability Details: CVE ID: CVE-2011-4362 Description: Integer signedness error i...

Security Bulletin: IBM System x and Flex Systems OpenSSH Vulnerabilities (CVE-2012-0814, CVE-2008-5161)

Summary Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Content Vulnerability Details:...

Security Bulletin: Weak Key Vulnerability in Remote Supervisor Adapter II firmware (CVE-2012-2187) - IBM System x3650, System x3850 M2, System x3950 M2

Summary Customers using secure network protocols such as https and ssh with the Remote Supervisor Adapter II are impacted by a recently discovered weakness in the generation of RSA keys that are used with those protocols. The weakness in the key generation process may allow the corresponding...

Security Bulletin: Security vulnerability has been identified in IBM Tivoli Monitoring, Tivoli Provisioning Manager for OS Deployment and IBM Tivoli Monitoring for Energy Management shipped with IBM System Director Editions (CVE-2014-0963, CVE-2014-0076)

Summary A security vulnerability has been identified in IBM Tivoli Monitoring, Tivoli Provisioning Manager for OS Deployment and IBM Tivoli Monitoring for Energy Management shipped with IBM System Director Editions. CVE-2014-0963, CVE-2014-0076 Vulnerability Details Abstract IBM Tivoli Monitoring...

CVE-2018-9085

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

PT-2018-18846

Name of the Vulnerable Software and Affected Versions Lenovo and IBM System x servers affected versions not specified Description A security issue was found in older generation Lenovo and IBM System x servers. The problem is related to a write protection lock bit that is not set after the system...

CVE-2018-9085: Incorrect Default Permissions

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

Security Bulletin: Vulnerability in SSLv3 affects Host On-Demand (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational Host On-Demand. Vulnerability Details CVE-ID: CVE-2014-3566 Description: Product could allow a remote attacker to obtain sensitive...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The CVE-2018-9068 issue affects IBM/Lenovo Integrated Management Module II (IMM2) FFDC data disclosure. In affected IMM2 firmware (Lenovo System x prior to 4.90 and IBM System x prior to 6.80), the SFTP server used for FFDC data access used hard-coded credentials described in the IMM2 documentati...

PT-2018-18829

Name of the Vulnerable Software and Affected Versions Lenovo System x versions prior to 4.90 IBM System x versions prior to 6.80 Description The issue concerns the IMM2 First Failure Data Capture function, which collects management module logs and diagnostic information when a hardware error is...

CVE-2018-9068: Use of Hard-coded Credentials

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

Information disclosure

The Fibre Channel over Ethernet FCoE feature in IBM System Networking and Blade Network Technology BNT switches running IBM Networking Operating System aka NOS, formerly BLADE Operating System floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow...

CVE-2013-0570

The Fibre Channel over Ethernet FCoE feature in IBM System Networking and Blade Network Technology BNT switches running IBM Networking Operating System aka NOS, formerly BLADE Operating System floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow...

Security Bulletin: Multiple vulnerabilities in IBM SDK affect IBM Systems Director Editions

Summary Tivoli Common Reporting , IBM Tivoli Monitoring and Tivoli Application Dependency Discovery Manager are shipped as components of IBM Systems Director Editions. Information about a security vulnerability affecting the above components has been published in a security bulletin. Vulnerabilit...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM System Storage Storwize SONAS (CVE-2014-6512 and CVE-2014-6457)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM System Storage SONAS. This issue was disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVEID: CVE-2014-6512 DESCRIPTION: Oracle Java SE and...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM System Storage SONAS (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM System Storage SONAS Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafted, but val...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM System Storage Storwize V7000 Unified (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM System Storage Storwize V7000 Unified Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM System Storage Storwize V7000 Unified (CVE-2014-6512 and CVE-2014-6457)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM System Storage Storwize V7000 Unified. This issue was disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVEID: CVE-2014-6512 DESCRIPTION: A...