PT-2018-12372 · Ibm · Ibm Db2+2

Publicado 2018-03-22 · Atualizado 2020-08-24 · CVE-2018-1426

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM GSKit (IBM DB2 for Linux, UNIX and Windows) versions 9.7 through 11.1

Description The issue concerns a problem with the PRNG state being duplicated across fork() system calls when multiple ICC instances are loaded, potentially leading to duplicate Session IDs and a risk of duplicate key material. Additionally, the GSKit CMS KDB logic fails to properly salt the hash function, resulting in weaker protection of passwords, which may allow a weak password to be recovered.

Recommendations For versions 9.7 through 11.1, update the software to address the issue with PRNG state duplication and hash function salting, and then change passwords to ensure they are stored more securely.

Correção

Enumeração de Fraquezas

CWE-335

Identificadores relacionados

CVE-2018-1426

Produtos afetados

Ibm Aix

Ibm Db2

Ibm Gskit

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-1426 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/139071 · Aviso do Fabricante
• http://securityfocus.com/bid/105580 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1426 · Nota de Segurança
• http://securitytracker.com/id/1041012 · Nota
• http://ibm.com/support/docview.wss?uid=swg22013756 · Aviso do Fabricante