PT-2017-6364 · Ibm · Ibm Flex System En6131 40Gb Ethernet+1

Published 2017-08-25 · Updated 2017-08-30 · CVE-2014-9564

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware versions prior to 3.4.1110

Description The issue allows remote attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This can result in web cache poisoning or cross-site scripting (XSS) attacks, or allow attackers to obtain sensitive information via multiple unspecified parameters.

Recommendations For versions prior to 3.4.1110, update the firmware to version 3.4.1110 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP endpoints to minimize the risk of exploitation. Avoid using unspecified parameters in the affected HTTP requests until the issue is resolved.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2014-9564

Affected Products

Ib6131 40Gb Infiniband Switch

Ibm Flex System En6131 40Gb Ethernet

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-9564 · Security Note
• https://ibm.com/support/home/docdisplay?lndocid=MIGR-5098173 · Vendor Advisory
• http://securityfocus.com/bid/74931 · Note