Multiple vulnerabilities in IBM Sterling File Gateway
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 14 |
| CVE-ID | CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000339 CVE-2020-26939 CVE-2016-1000341 CVE-2017-13098 CVE-2020-15522 CVE-2016-1000352 CVE-2016-1000344 CVE-2016-1000338 CVE-2016-1000340 CVE-2018-1000180 CVE-2016-1000342 CVE-2016-1000343 |
| CWE-ID | CWE-200 CWE-320 CWE-310 CWE-208 CWE-347 CWE-20 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #6 is available. |
| Vulnerable software |
IBM Sterling File Gateway Server applications / File servers (FTP/HTTP) |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 14 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU86069
Risk: Medium
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2016-1000345
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to DHIES/ECIES CBC mode vulnerable to padding oracle attack. A remote attacker with enough observations can identify when the decryption is failing due to padding.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Key management errors
EUVDB-ID: #VU86068
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000346
CWE-ID:
CWE-320 - Key Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the other party DH public key is not fully validated.. A remote attacker can gain unauthorized access to sensitive information on the system and reveal details about the other party's private key where static Diffie-Hellman is in use.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Cryptographic issues
EUVDB-ID: #VU13587
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000339
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability is present in Bouncy Castle JCE Provider due to usage of AESFastEngine that does not provide the sufficient level of secrecy and is prone to side-channel attacks.
Mitigation
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Information disclosure
EUVDB-ID: #VU48199
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-26939
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to observable differences in behavior to error inputs within the org.bouncycastle.crypto.encodings.OAEPEncoding component in Legion of the Bouncy Castle BC. A remote attacker can obtain sensitive information about a private exponent by sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder. This causes the application to throw an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Cryptographic issues
EUVDB-ID: #VU13589
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000341
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists in Bouncy Castle JCE Provider implementation of DSA signature generation process. The attacker with ability to observe timings for the generation of signatures can gain information about the signature's k value and ultimately the private value as well.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Information disclosure
EUVDB-ID: #VU9750
Risk: Low
CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Clear]
CVE-ID: CVE-2017-13098
CWE-ID:
CWE-200 - Information exposure
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to the application is susceptible to a chosen ciphertext attack when negotiating an RSA key exchange for any TLS cipher suite. A remote attacker can conduct man-in-the-middle attack and decrypt HTTPS traffic or impersonate the HTTPS server.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
7) Information Exposure Through Timing Discrepancy
EUVDB-ID: #VU55035
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-15522
CWE-ID:
CWE-208 - Information Exposure Through Timing Discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The
vulnerability exists due to a timing issue within the EC math library. A remote attacker who can observe timing information for the generation of multiple deterministic ECDSA signatures is able to reconstruct the private key used for encryption.
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Cryptographic issues
EUVDB-ID: #VU86062
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2016-1000352
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to modify data on the system. The vulnerability exists due to ECIES implementation allowed the use of ECB mode. A remote attacker can trigger the vulnerability to bypass security restrictions and escalate privileges on the system.
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Cryptographic issues
EUVDB-ID: #VU86066
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2016-1000344
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to modify data on the system.
The vulnerability exists due to DHIES implementation allowed the use of ECB mode. A remote attacker can trigger the vulnerability to modify data on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Improper verification of cryptographic signature
EUVDB-ID: #VU13586
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000338
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
Description
The vulnerability allows a remote attacker to bypass signature validation process.
The JCE Provider in Bouncy Castle does not fully validate ASN.1 encoding of signature on verification within DSA implementation. A remote attacker can inject extra elements in the sequence making up the signature, which will be considered valid allowing an attacker to add extra data into a signed structure.
Mitigation
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Cryptographic issues
EUVDB-ID: #VU13588
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000340
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists in Bouncy Castle JCE Provider due to buggy implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Improper input validation
EUVDB-ID: #VU27043
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2018-1000180
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the IDIH Visualization (Bouncy Castle Java Library) component in Oracle Communications Diameter Signaling Router (DSR). A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Improper verification of cryptographic signature
EUVDB-ID: #VU13590
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000342
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
Description
The vulnerability allows a remote attacker to bypass signature validation process.
The JCE Provider in Bouncy Castle does not fully validate ASN.1 encoding of signature on verification within ECDSA implementation. A remote attacker can inject extra elements in the sequence making up the signature, which will be considered valid allowing an attacker to add extra data into a signed structure.
Mitigation
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Cryptographic issues
EUVDB-ID: #VU13591
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-1000343
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists in Bouncy Castle JCE Provider implementation of DSA key pair generator that generates a weak private key (1024 bit key size) if used with default values. The attacker can use this vulnerability to decrypt data.
Install update from vendor's website.
Vulnerable software versionsIBM Sterling File Gateway: before 6.0.3.7
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
