IBM Support

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM i

Security Bulletin


Summary

Node.js is supported by IBM i. IBM i has addressed the vulnerabilities.

Vulnerability Details

CVEID: CVE-2019-9517
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by an Internal Data Buffering attack. By opening the HTTP/2 window so the peer can send without constraint and sending a stream of requests for a large response object, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/165183 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9518
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Empty Frame Flooding attack. By sending a stream of frames with an empty payload and without the end-of-stream flag, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/164904 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9515
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Settings Flood attack. By sending a stream of SETTINGS frames to the peer, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/165181 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9516
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a 0-Length Headers Leak attack. By sending a stream of headers with a 0-length header name and 0-length header value, a remote attacker could consume excessive memory resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/165182 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9513
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Resource Loop attack. By creating multiple request streams and continually shuffling the priority of the streams, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/164639 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9514
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Reset Flood attack. By opening a number of streams and sending an invalid request over each stream, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/164640 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9511
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Data Dribble attack. By sending a HTTP/2 request by the HTTP/2 protocol stack (HTTP.sys) for an overly large amount of data from a specified resource over multiple streams, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/164638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-9512
DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Ping Flood attack. By sending continual pings to an HTTP/2 peer, a remote attacker could consume excessive CPU resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/164903 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Releases 7.4, 7.3 and 7.2 of IBM i are affected.

Remediation/Fixes

Releases 7.4, 7.3 and 7.2 of IBM i are supported and will be fixed.  The issue can be fixed by installing an rpm update based on Node.js version.

IBM recommends users stay up to date with all packages. 
Command line instructions:
To update all installed packages
yum upgrade
To only update Node.js 12 to the latest version
yum upgrade nodejs12
To only update Node.js 10 to the latest version
yum upgrade nodejs10
To only update Node.js 8 to the latest version
yum upgrade nodejs8
ACS GUI instructions:
Open the ACS Package Management GUI using Tools -> Open Source Package Management.
From the Updates Available tab, select the packages to update (multiples can be selected using Ctrl + click).
When all packages have been selected, click the Upgrade button and follow the directions on the terminal.
Updated packages:
nodejs12-12.8.1-1.ibmi7.2.ppc64.rpm
nodejs10-10.16.3-1.ibmi7.2.ppc64.rpm
nodejs8-8.16.1-1.ibmi7.2.ppc64.rpm

Note: More recent versions of these packages may be available.

For more information about the packages in rpm format, see http://ibm.biz/ibmi-rpms

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

26 September 2019: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Business Unit":{"code":"BU009","label":"Systems - Server"},"Product":{"code":"SGYQGH","label":"IBM i"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2,7.3,7.4","Edition":""},{"Business Unit":{"code":"BU009","label":"Systems - Server"},"Product":{"code":"SSC5L9","label":"IBM i 7.2"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2","Edition":""},{"Business Unit":{"code":"BU009","label":"Systems - Server"},"Product":{"code":"SSTS2D","label":"IBM i 7.3"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3","Edition":""},{"Business Unit":{"code":"BU009","label":"Systems - Server"},"Product":{"code":"SS9QQS","label":"IBM i 7.4"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.4","Edition":""}]

Document Information

Modified date:
26 September 2019

UID

ibm11072144