PT-2014-2920 · Ibm · Ibm Networking Operating System+3

Publicado 2014-01-02 · Atualizado 2014-01-28 · CVE-2013-5385

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM i versions 6.1 through 7.1 z/OS on zSeries servers (affected versions not specified) Networking Operating System (NOS) (affected versions not specified)

Description The issue concerns the OSPF implementation, which fails to properly validate Link State Advertisement (LSA) type 1 packets. This allows remote attackers to cause a denial of service, resulting in routing disruption, or obtain sensitive packet information by sending a crafted LSA packet.

Recommendations For IBM i versions 6.1 through 7.1, update the OSPF implementation to properly validate LSA type 1 packets. For z/OS on zSeries servers, apply the necessary configuration changes to the OSPF implementation to prevent the issue. For Networking Operating System (NOS), restrict access to the LSA database until a proper validation mechanism is implemented. As a temporary workaround, consider disabling the OSPF implementation until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-5385

Produtos afetados

Ibm I

Ibm Networking Operating System

Z/Os

Zseries

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-5385 · Nota de Segurança
• http://kb.cert.org/vuls/id/229804 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=nas8N1010309 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/BLUU-985QTG · Nota
• http://www-01.ibm.com/support/docview.wss?uid=isg3T1019716 · Nota