Security Bulletin
Summary
IBM Dynamic System Analysis (DSA) Preboot has addressed the following vulnerabilities in libtirpc.
Vulnerability Details
CVEID: CVE-2018-14622
DESCRIPTION: Libtirpc is vulnerable to a denial of service, caused by a NULL pointer dereference in the rpc-based application. By flooding the applications with new connections, a remote attacker could exploit this vulnerability to exhaust the resources.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/149185 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2018-14621
DESCRIPTION: Libtirpc is vulnerable to a denial of service, caused by an error in EMFILE case in svc_vc.c. By using poll rather than select, a local attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/149184 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
Product |
Affected Version |
IBM Dynamic System Analysis (DSA) Preboot |
9.6 |
Remediation/Fixes
Firmware fix versions are available on Fix Central: http://www.ibm.com/support/fixcentral/
Product |
Fix Version |
IBM Dynamic System Analysis (DSA) Preboot |
dsyte2z-9.65 |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
23 April 2019: Initial version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
23 April 2019
UID
ibm10874448