Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2017-5644
CVE-2019-12415
CVE-2014-3574
CVE-2014-3529
CWE-ID CWE-776
CWE-611
Exploitation vector Network
Public exploit N/A
Vulnerable software
 IBM Intelligent Operations Center
Server applications / Other server solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) XML Entity Expansion

EUVDB-ID: #VU86355

Risk: Low

CVSSv3.1: 4.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-5644

CWE-ID: CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to insufficient validation of user-supplied XML input. A local user can pass a specially crafted OOXML file to the affected application and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Intelligent Operations Center: 5.1.0 - 5.2.3

CPE2.3 External links

http://www.ibm.com/support/pages/node/7030627


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) XML External Entity injection

EUVDB-ID: #VU22545

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12415

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents. A remote attacker can pass a specially crafted XML code to the affected application and read files from the local filesystem or from internal network resources on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Intelligent Operations Center: 5.1.0 - 5.2.3

CPE2.3 External links

http://www.ibm.com/support/pages/node/7030627


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) XML External Entity injection

EUVDB-ID: #VU86352

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-3574

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted OOXML file to the affected application and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Intelligent Operations Center: 5.1.0 - 5.2.3

CPE2.3 External links

http://www.ibm.com/support/pages/node/7030627


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) XML External Entity injection

EUVDB-ID: #VU86349

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-3529

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Intelligent Operations Center: 5.1.0 - 5.2.3

CPE2.3 External links

http://www.ibm.com/support/pages/node/7030627


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###