SB2018042479 - Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
Published: April 24, 2018 Updated: February 17, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2018-5732)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the dhclient due to buffer overflow. A remote attacker can send specially crafted response, trigger memory corruption and cause the service to crash.
2) Spoofing attack (CVE-ID: CVE-2017-12132)
The vulnerability allows a remote attacker to perform spoofing attack and write arbitrary files on the target system.The weakness exists in the DNS stub resolver due to soliciting large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation, when EDNS support is enabled. A remote attacker can write arbitrary files.
3) Denial of service (CVE-ID: CVE-2017-8804)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in xdr_bytes() and xdr_string() functions when processing RPC data in the GNU C Library (aka glibc or libc6). A remote unauthenticated attacker can send a specially crafted UDP request to port 111 (rpcbind) and consume up to 4 gigabytes of memory per request.
Successful exploitation of this vulnerability may result in denial of service (DoS) conditions.
The issue is related to: https://www.cybersecurity-help.cz/vdb/SB2017050801
4) Privilege escalation (CVE-ID: CVE-2018-1000001)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists in due to a change in the processing of pathnames in the getcwd() command introduced in Linux kernel. A local attacker can use a specially crafted application, trigger buffer underflow in the __realpath() function in 'stdlib/canonicalize.c' and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability may result in system compromise.
5) Integer overflow (CVE-ID: CVE-2018-6485)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists in the implementation of the posix_memalign in memalign functions due to integer overflow when causing these functions to return a pointer to a heap area that is too small. A remote attacker can trigger memory corruption and gain root privileges.
6) Integer overflow (CVE-ID: CVE-2018-6551)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists in the malloc implementation due to improper handling of malloc calls with arguments close to SIZE_MAX and returning a pointer to a heap region that is smaller than requested. A remote attacker can gain root privileges.
7) Memory corruption (CVE-ID: CVE-2017-1000366)
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to memory management errors in implementation of various functions under multiple operating systems. A local or remote attacker can trigger the affected application to process specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
8) Memory corruption (CVE-ID: CVE-2018-5733)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the dhcpd due to improper handling of reference counting when processing client requests. A remote attacker can send large amounts of data to the target server can send a large number of packets, trigger a reference counter overflow and cause the target dhcpd service to consume all available memory and crash.
9) Resource exhaustion (CVE-ID: CVE-2017-3144)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to improper cleaning up of closed OMAPI connections. A remote attacker who is permitted to establish connections to the OMAPI control port can trigger exhaustion of the pool of socket descriptors available to the DHCP server and cause the service to crash.
10) Out-of-bounds read (CVE-ID: CVE-2017-1000254)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to out-of-bounds read when parsing a directory name when connecting to an FTP server. A remote attacker can trigger memory corruption, access arbitrary files and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
11) Heap-based buffer overflow (CVE-ID: CVE-2018-1000120)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to heap-based buffer overflow. A remote attacker that can control the paths that curl uses for FTP can create specially crafted path names containing the control characters '%00', trigger memory corruption and execute arbitrary code.
12) Null pointer dereference (CVE-ID: CVE-2018-1000121)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to NULL pointer dereference in ldap_get_attribute_ber(). A remote attacker can return a specially crafted redirect to an LDAP URL, trigger NULL pointer dereference and cause the service to crash.//
13) Buffer over-read (CVE-ID: CVE-2018-1000122)
The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition.The weakness exists due to buffer over-read. A remote attacker can cause the target application to trigger a buffer copy error in processing RTSP URLs and cause the application to crash or access potentially sensitive information on the target system.
14) Open redirect (CVE-ID: CVE-2017-1000100)
The vulnerability allows a remote attacker to redirect website visitors to external websites.The weakness exists due to incorrect validation of redirected URL. A remote attacker can redirect the target user's curl request to a TFTP URL with a long filename to cause the target user's curl application to send portions of system memory.
Successful exploitation of the vulnerability results in information disclosure.
Remediation
Install update from vendor's website.