IBM z/Transaction Processing Facility update for Apache Kafka



| Updated: 2024-04-19
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2023-25194
CVE-2023-23931
CWE-ID CWE-502
CWE-388
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 z/Transaction Processing Facility ( z/TPF)
Server applications / Other server solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Deserialization of Untrusted Data

EUVDB-ID: #VU72123

Risk: Low

CVSSv4.0: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2023-25194

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to Apache Kafka Connect performs deserialization of data retrieved from the configured LDAP server in "com.sun.security.auth.module.JndiLoginModule". A remote user ability to create/modify connectors on the server with an arbitrary Kafka client SASL JAAS config can configure the server to connect to a malicious LDAP server and execute arbitrary Java code on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

z/Transaction Processing Facility ( z/TPF): 1.1

CPE2.3 External links

https://www.ibm.com/support/pages/node/6962437


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) Error Handling

EUVDB-ID: #VU72036

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23931

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows an attacker to misuse Python API.

The vulnerability exists due to a soundness bug within the Cipher.update_into function, which can allow immutable objects (such as bytes) to be mutated. A malicious programmer can misuse Python API to introduce unexpected behavior into the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

z/Transaction Processing Facility ( z/TPF): 1.1

CPE2.3 External links

https://www.ibm.com/support/pages/node/6962437


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###