Multiple vulnerabilities in IBM DS8000 Hardware Management Console



| Updated: 2024-10-25
Risk Critical
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2022-22965
CVE-2022-0778
CVE-2021-26691
CVE-2021-40438
CVE-2021-44790
CVE-2021-20325
CWE-ID CWE-94
CWE-835
CWE-476
CWE-918
CWE-119
Exploitation vector Network
Public exploit Vulnerability #1 is being exploited in the wild.
Public exploit code for vulnerability #2 is available.
Vulnerability #4 is being exploited in the wild.
Public exploit code for vulnerability #5 is available.
Vulnerable software
 IBM DS8000 Hardware Management Console
Server applications / Remote management servers, RDP, SSH

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Code Injection

EUVDB-ID: #VU61756

Risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2022-22965

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted HTTP request to the affected application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

This vulnerability was dubbed "Spring4Shell".

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Infinite loop

EUVDB-ID: #VU61391

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-0778

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) NULL pointer dereference

EUVDB-ID: #VU53776

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-26691

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mod_session. A a malicious backend server or SessionHeader can trigger a denial of service (DoS) condition.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU56678

Risk: High

CVSSv4.0: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2021-40438

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: Yes

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the mod_proxy module in Apache HTTP Server. A remote attacker can send a specially crafted HTTP request with a chosen uri-path and trick the web server to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

5) Buffer overflow

EUVDB-ID: #VU59056

Risk: Critical

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Red]

CVE-ID: CVE-2021-44790

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing multipart content in mod_lua. A remote attacker can send a specially crafted HTTP request to the affected web server, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Buffer overflow

EUVDB-ID: #VU64068

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-20325

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM DS8000 Hardware Management Console: before 89.30.68.0

CPE2.3 External links

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-have-been-identified-in-spring-framework-openssl-and-apache-http-server-shipped-with-the-ds8000-hardware-management-console-hmc/
https://www.ibm.com/support/pages/node/6592963


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###