PT-2018-12539 · Ibm · Ibm Spectrum Protect Snapshot+3

Published 2018-04-04 · Updated 2019-10-03 · CVE-2018-1447

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect versions 7.1 through 7.2 IBM Spectrum Protect Snapshot versions 4.1.3, 4.1.4, 4.1.6

Description The GSKit CMS KDB logic fails to salt the hash function, resulting in weaker than expected protection of passwords. This weakness may allow a weak password to be recovered.

Recommendations For IBM Spectrum Protect versions 7.1 and 7.2, update to a newer version and change passwords to ensure they are stored more securely. For IBM Spectrum Protect Snapshot versions 4.1.3, 4.1.4, and 4.1.6, update to a newer version and change passwords to ensure they are stored more securely.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2018-1447

Affected Products

Gskit

Ibm Aix

Ibm Spectrum Protect

Ibm Spectrum Protect Snapshot

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1447 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22015066 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22015071 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22014669 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/139972 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22014957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1447 · Vendor Advisory
• http://securityfocus.com/bid/104511 · Note
• http://securitytracker.com/id/1041012 · Note