Multiple vulnerabilities in IBM Edge Application Manager

1) Improper Privilege Management

EUVDB-ID: #VU72321

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36109

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management caused by improper setup of supplementary groups. A local user can bypass primary group restrictions and compromise the container.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Edge Application Manager: 4.3 - 4.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.3:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.4:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/6991565

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU64818

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20699

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker on the local network can cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Edge Application Manager: 4.3 - 4.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.3:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.4:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/6991565

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU61600

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-24769

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to containers are incorrectly started with non-empty inheritable Linux process capabilities, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Edge Application Manager: 4.3 - 4.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.3:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_edge_application_manager:4.4:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/6991565

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.