Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller and Storwize Family (CVE-2015-0488, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM SAN Volume Controller and Storwize Family. These issue was disclosed as part of the IBM Java SDK updates in Apr 2015. Vulnerability Details CVEID:CVE-2015-0488 DESCRIPTION: An...

Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)

Summary Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family CVE-2011-3389 Vulnerability Details Security Bulletin --- Summary --- SSL and TLS vulnerabilities were disclosed in September 2011. This vulnerability has been referred to as the...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( CVE-2018-11784)

Summary A vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud and IBM FlashSystem V9000 and 9100 family products. Apache Tomcat is used in the management GUI of the...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM SAN Volume Controller and Storwize Family (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SAN Volume Controller and Storwize Family Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacke...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM SAN Volume Controller and Storwize Family (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM SAN Volume Controller and Storwize Family Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by th...

Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2012-6354)

Problem Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family CVE-2012-6354 Resolving The Problem Security Bulletin --- Summary --- Administrative access to the system via the GUI may be obtained without supplying proper credentials. Vulnerability...

Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family (CVE-2014-4811)

Summary Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family CVE-2014-4811 Vulnerability Details Security Bulletin --- Summary --- The administrator superuser password can be reset to a default value without requiring prior...

Security Bulletin: OpenSSL vulnerability in IBM SAN Volume Controller and Lenovo Storwize Family (CVE-2014-0224)

Summary An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle MITM attack where the attacker can decrypt and modify traffic from the attacked client and server. Vulnerability...

Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2012-6354)

Abstract Administrative access to the system via the GUI may be obtained without supplying proper credentials. Content VULNERABILITY DETAILS CVEID: CVE-2012-6354 DESCRIPTION: The vulnerability can be exploited by a user with access to the system's management IP interface. If successful the user c...

Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965)

Abstract Administrative access to the system via the IP interface may be obtained without authentication. Content VULNERABILITY DETAILS: CVEID: CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 DESCRIPTION: The vulnerabilities can be exploited by a...

Security Bulletin: Java vulnerability on IBM SAN Volume Controller and Storwize Family (CVE-2014-0411)

Summary Java vulnerability could allow decryption of long GUI session Vulnerability Details CVEID: CVE-2014-0411 DESCRIPTION: Java is used in the system’s GUI. Timing differences based on the validity of messages can be exploited to decrypt the entire session. The exploit is not trivial, requirin...

Security Bulletin: Vulnerabilities in Bash affect SAN Volume Controller and Storwize Family (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. These vulnerabilities have been referred to as “Bash Bug” or “Shellshock”. Bash is used by SAN Volume Controller and Storwize Family including the IBM Flex System V7000. Vulnerability Details The following vulnerabilities are only...

Security Bulletin: GUI DoS vulnerability in SAN Volume Controller and Storwize Family (CVE-2014-0050)

Summary GUI interface can be disrupted by exploitation of Apache Tomcat vulnerability Vulnerability Details CVEID: CVE-2014-0050 DESCRIPTION: This bulletin relates to vulnerabilities in the Apache Tomcat component which, if successfully exploited, could stop the product’s web server and deny acce...

Security Bulletin: CLI access security issue on IBM SAN Volume Controller and Storwize Family (CVE-2014-0880)

Summary CLI security issue Vulnerability Details CVEID: CVE-2014-0880 DESCRIPTION: An unauthorized user with network access to a system's administrative IP Internet Protocol address may be able to gain CLI Command Line Interface access to the system, allowing the user to issue all administrative...

Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2014-7809)

Summary An Open Source Apache Struts vulnerability was disclosed in August 2014. Struts is used by SAN Volume Controller and Storwize Family. Vulnerability Details CVEID: CVE-2014-7809 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by predictable...

Security Bulletin: Apache Tomcat vulnerabilities on IBM SAN Volume Controller and Storwize Family (CVE-2013-4286 CVE-2013-4332 CVE-2014-0075 CVE-2014-0099)

Summary Apache Tomcat DoS and unauthorized access vulnerabilities Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID:CVE-2013-4286 DESCRIPTION: Apache Tomcat is...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM SAN Volume Controller and Storwize Family (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511)

Summary Vulnerabilities in OpenSSL could allow a remote attacker to execute arbitrary code or cause a denial of service. Vulnerability Details CVE-ID:CVE-2014-3509 DESCRIPTION : OpenSSL is vulnerable to a denial of service, caused by a race condition in the sslparseserverhellotlsext code. If a...

Security Bulletin: Potential DOS due to weak IPv4 and IPv6 sequence numbers in SAN Volume Controller and Storwize Family (CVE-2011-3188)

Summary Potential DOS due to weak IPv4 and IPv6 sequence numbers Vulnerability Details CVEID: CVE-2011-3188 DESCRIPTION: The 1 IPv4 and 2 IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes i...

Security Bulletin: Hardware failure diagnostic information can include customer data fragments in SAN Volume Controller and Storwize Family (CVE-2013-6737)

Summary Hardware failure diagnostics for a 1691 error include customer data fragments that may be copied from the system by an authorized user who might not otherwise have access to that data. Vulnerability Details CVEID: CVE-2013-6737 DESCRIPTION: In the event of a rare hardware fault error code...

Security Bulletin: Vulnerabilities in Network Security Services (NSS) and Netscape Portable Runtime (NSPR) affect IBM SAN Volume Controller and Storwize Family (CVE-2013-1740, CVE-2014-1490, CVE-2014-1491, CVE-2014-1492, CVE-2014-1544, CVE-2014-1545)

Summary Vulnerabilities in Network Security Services NSS and Netscape Portable Runtime NSPR could allow a remote attacker to obtain sensitive information or cause a denial of service. Vulnerability Details CVE-ID : CVE-2013-1740 DESCRIPTION : Mozilla Network Security Services could allow a remote...