PT-2017-12976 · Ibm · Ibm Spectrum Protect

Publicado 2017-10-05 · Atualizado 2019-10-03 · CVE-2017-1339

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect versions 7.1 through 8.1

Description The issue concerns the use of weak encryption for passwords in IBM Spectrum Protect Server, which could allow a database administrator to decrypt client or administrator passwords. This may lead to information disclosure or a denial of service.

Recommendations For IBM Spectrum Protect versions 7.1 through 8.1, consider changing the password encryption method to a stronger one to prevent potential decryption by a database administrator. As a temporary workaround, restrict access to sensitive data and limit database administrator privileges until a more secure encryption method is implemented.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2017-1339

Produtos afetados

Ibm Spectrum Protect

Referências · 6

• http://securitytracker.com/id/1039498 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/126247 · Aviso do Fabricante
• http://securityfocus.com/bid/101113 · Nota
• https://osv.dev/vulnerability/CVE-2017-1339 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg22007936 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1339 · Nota de Segurança