Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in openssh (CVE-2016-10009 CVE-2016-10011 CVE-2016-10012 CVE-2016-6210 CVE-2016-6515)

Summary IBM QRadar Network Security has addressed vulnerabilities in openssh. Vulnerability Details CVEID: CVE-2016-6515 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by the failure to limit password lengths for password authentication by the authpassword function. A remote...

Security Bulletin: A vulnerability in OpenSSH affects IBM Security Network Protection (CVE-2015-8325)

Summary A security vulnerability has been discovered in OpenSSH, which is used by IBM Security Network Protection. Vulnerability Details CVEID: CVE-2015-8325 DESCRIPTION: OpenSSH could allow a local attacker to gain elevated privileges on the system, caused by an error in the dosetupenv function...

Security Bulletin: Fixes for Multiple Security Vulnerabilities in IBM Security Identity Manager Virtual Appliance available

Summary There are multiple security vulnerabilities in various components used by IBM Security Identity Manager Virtual Appliance Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to bypass security restrictions, caused by an error when...

Security Bulletin: IBM Security Access Manager appliances are affected by vulnerabilities in OpenSSH (CVE-2015-5352, CVE-2015-6563, CVE-2015-6564)

Summary Vulnerabilities have been identified in OpenSSH. IBM Security Access Manager appliances use OpenSSH and are affected by these vulnerabilities. Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to bypass security restrictions, cause...

Security Bulletin: Vulnerabilities in Open Source openssh affect IBM Security Identity Governance Appliance (CVE-2015-5352, CVE-2015-6563, CVE-2015-6564 )

Summary IBM Security Identity Governance 5.2.1 appliances are affected by a vulnerability in openssh. Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to bypass security restrictions, caused by an error when making connections after...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM Security Network Protection (CVE-2015-5352, CVE-2015-6563, and CVE-2015-6564)

Summary Security vulnerabilities have been discovered in OpenSSH, which is used by IBM Security Network Protection. Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to bypass security restrictions, caused by an error when making connectio...

Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in OpenSSH (CVE-2016-3115, CVE-2016-1908)

Summary Vulnerabilities have been identified in OpenSSH. IBM Security Access Manager for Web uses OpenSSH and is affected by these vulnerabilities. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the...

Security Bulletin: IBM Security Access Manager for Mobile is affected by vulnerabilities in OpenSSH (CVE-2016-3115, CVE-2016-1908)

Summary Vulnerabilities have been identified in OpenSSH. IBM Security Access Manager for Mobile uses OpenSSH and is affected by these vulnerabilities. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by vulnerabilities in OpenSSH (CVE-2013-4548)

Summary Security vulnerabilities have been discovered in OpenSSH. Vulnerability Details CVE-ID: CVE-2013-4548 DESCRIPTION: A memory corruption vulnerability exists in the post-authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during ke...

Security Bulletin: Security Vulnerabilities in OpenSSL, glibc, gcc, Net-SNMP, and OpenSSH affect IBM Security Proventia Network Enterprise Scanner

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM Security Proventia Network Enterprise Scanner. This bulletin addresses the applicable CVEs as well as other CVEs related to glibc, gcc, Net-SNMP, and OpenSSH. CVE-2015-5600,...

Security Bulletin: IBM Security Access Manager for Mobile is affected by an OpenSSH vulnerability (CVE-2008-5161)

Summary IBM Security Access Manager for Mobile has SSH Server Cipher Block Chaining CBC mode ciphers enabled, which could allow an attacker to recover the plaintext message from the ciphertext. Vulnerability Details CVEID: CVE-2008-5161 DESCRIPTION: OpenSSH and multiple SSH Tectia products could...

Security Bulletin: CBC mode ciphers, weak MD5 and MAC algorithms vulnerabilities in OpenSSH affect IBM Security Network Protection (CVE-2008-5161)

Summary CBC mode ciphers, weak MD5 and MAC algorithms vulnerabilities have been discovered in OpenSSH used with IBM Security Network Protection. These vulnerabilities have been addressed in the firmware versions below. Vulnerability Details CVEID: CVE-2008-5161 DESCRIPTION: OpenSSH and multiple S...

Security Bulletin: IBM Security Access Manager for Web is affected by an OpenSSH vulnerability (CVE-2008-5161)

Summary IBM Security Access Manager for Web has SSH Server Cipher Block Chaining CBC mode ciphers enabled, which could allow an attacker to recover the plaintext message from the ciphertext. Vulnerability Details CVEID: CVE-2008-5161 DESCRIPTION: OpenSSH and multiple SSH Tectia products could all...

Security Bulletin: A vulnerability in OpenSSH affects IBM Security Network Protection (CVE-2015-5600)

Summary A security vulnerability has been discovered in OpenSSH used with IBM Security Network Protection. Vulnerability Details CVEID: CVE-2015-5600 DESCRIPTION: OpenSSH could allow a local attacker to obtain sensitive information, caused by an error in the keyboard-interactive authentication...

Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Transactions (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureData™ System for Transactions. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerability in OpenSSH affects IBM DataPower Gateways (CVE-2017-15906)

Summary A potential Denial of Service vulnerability exists in OpenSSH. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM MQ Appliance (CVE-2016-0777)

Summary An information leak flaw and buffer overflow flaw in the way the OpenSSH client roaming feature was implemented affects IBM MQ Appliance. Vulnerability Details CVEID: CVE-2016-0777 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by a client...

Security Bulletin: Vulnerabilities in Bash affect IBM Workload Deployer (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Bash is available in Red Hat Linux virtual machine images that can be deployed by using IBM Workload Deployer. Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory...

Design/Logic Flaw

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...

CVE-2011-4190

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...