PT-2014-3930 · Ibm · Ibm Flex System Manager

Publicado 2014-08-29 · Atualizado 2017-08-29 · CVE-2014-0897

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Flex System Manager versions 1.2.0.x through 1.3.1.x

Description The issue concerns the Configuration Patterns component in IBM Flex System Manager, which uses a weak algorithm during an encryption step in Chassis Management Module account creation. This weakness makes it easier for remote authenticated users to defeat cryptographic protection mechanisms.

Recommendations For versions 1.2.0.x through 1.3.1.x, consider restricting access to the Chassis Management Module account creation process until a fix is available. As a temporary workaround, restrict the use of the weak encryption algorithm in the Configuration Patterns component. Avoid using the affected Configuration Patterns component for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-0897

Produtos afetados

Ibm Flex System Manager

Referências · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg1IT03824 · Aviso do Fabricante
• http://ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096153 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0897 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91395 · Nota