IT46393: IBM SPECTRUM CONTROL SECURITY APAR FOR CVE-2024-21892, CVE-2024-22019, CVE-2024-27983, CVE-2024-27980

IBM Spectrum Control 5.4.12 - performance patch
IBM Spectrum Control 5.4.12 - Windows Server
IBM Spectrum Control 5.4.12 - Linux Server
IBM Spectrum Control 5.4.12 - AIX Server
IBM Spectrum Control 5.4.12 - Agents

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2024-21892
  Description: Node.js could allow a remote attacker to gain
  elevated privileges on the system, caused by a bug in the
  implementation of the exception of CAP_NET_BIND_SERVICE. An
  attacker could exploit this vulnerability to inject code that
  inherits the process's elevated privileges.
  
  CVEID: CVE-2024-22019
  Description: Node.js is vulnerable to a denial of service,
  caused by an error when reading unprocessed HTTP request with
  unbounded chunk extension. By sending a specially crafted HTTP
  request, an attacker could exploit this vulnerability to exhaust
  all available resources.
  
  CVEID: CVE-2024-27983
  Description: Node.js is vulnerable to a denial of service,
  caused by an assertion failure in
  node::http2::Http2Session::~Http2Session(). By sending a small
  amount of HTTP/2 frames packets with a few HTTP/2 frames inside,
  an attacker could exploit this vulnerability to cause the HTTP/2
  server to crash.
  
  CVEID: CVE-2024-27980
  Description: Node.js could allow a remote attacker to execute
  arbitrary commands on the system, caused by the improper
  handling of batch files in child_process.spawn /
  child_process.spawnSync. By sending a specially crafted command
  line argument using args parameter, an attacker could exploit
  this vulnerability to inject and execute arbitrary commands on
  the system.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control 5.4.0 - 5.4.11 users                    *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2024-21896, CVE-2024-21892,                              *
  * CVE-2024-22019, CVE-2024-27983,                              *
  * CVE-2024-27980                                               *
  *                                                              *
  * See security bulletin for details of the vulnerabilities:    *
  * https://www.ibm.com/support/pages/node/7159293               *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance.                                       *
  *                                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Spectrum Control 5.4.12   [ 5.4.12-IBM-SC ]
  
  https://www.ibm.com/support/pages/node/359939
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels