PT-2014-3930 · Ibm · Ibm Flex System Manager

Published 2014-08-29 · Updated 2017-08-29 · CVE-2014-0897

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Flex System Manager versions 1.2.0.x through 1.3.1.x

Description The issue concerns the Configuration Patterns component in IBM Flex System Manager, which uses a weak algorithm during an encryption step in Chassis Management Module account creation. This weakness makes it easier for remote authenticated users to defeat cryptographic protection mechanisms.

Recommendations For versions 1.2.0.x through 1.3.1.x, consider restricting access to the Chassis Management Module account creation process until a fix is available. As a temporary workaround, restrict the use of the weak encryption algorithm in the Configuration Patterns component. Avoid using the affected Configuration Patterns component for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-0897

Affected Products

Ibm Flex System Manager

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg1IT03824 · Vendor Advisory
• http://ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0897 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91395 · Note