IBM Support

Security Bulletin: This Power System update is being released to address CVE-2018-12384

Created by Sunitha Harish on
Published URL:
https://www.ibm.com/support/pages/node/873162
873162

Security Bulletin


Summary

POWER9: In response to a data leak vulnerability in the network security services, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-12384.
This man-in-the-middle attack could provide false completion or errant network transactions or exposure of sensitive data from intercepted SSL connections to ASMI, Redfish, or the service processor message server.

Vulnerability Details

CVEID: CVE-2018-12384
DESCRIPTION: Network Security Services (NSS) could allow a remote attacker to obtain sensitive information, caused by the improper handling of an SSLv2-compatible ClientHello message. By conducting a passive replay attack, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/150436 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
The firmware update can be obtained from FixCentral by specifying the Product and fix level as specified in this Remediation section.

Affected Products and Versions

Firmware releases FW910 and FW920 are affected.
Firmware releases FW810, FW820, FW830, FW840, FW860 are affected.

Remediation/Fixes

Customers with the products below, install FW910.30

1) IBM Power Systems S922 (9009-22A)

2) IBM Power Systems H922 (9223-22H)

3) IBM Power Systems S914 (9009-41A)

4) IBM Power Systems S924 (9009-42A)

5) IBM Power Systems H924 (9223-42H)

6) IBM Power Systems L922 (9008-22L)

Customers with the products below, install FW920.30

1) IBM Power Systems E950(9040-MR9)

2) IBM Power Systems E980(9080-M9S)

Customers with the products below, install FW860.70

1) IBM Power System S812(8284-21A)

2) IBM Power System S822(8284-22A)

3) IBM Power System S814(8286-41A)

4) IBM Power System S824(8286-42A)

5) IBM Power System S812L(8247-21L)

6) IBM Power System S822L(8247-22L)

7) IBM Power System S824L(8247-42L)

8) IBM Power System E850(8408-E8E)

9) IBM Power System E850C(8408-44E)

10) IBM Power System E870(9119-MME)

11) IBM Power System E870C(9080-MME)

12) IBM Power System E880(9119-MHE)

13) IBM Power System E880C(9080-MHE)

14) IBM Power System S812L(5148-21L)

15) IBM Power System S822L(5148-22L)

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SGDMMD","label":"Power System AC922 Server (8335-GTC)"},"Component":"","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"FW920 FW910","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"HW1A1","label":"IBM Power Systems"},"Component":"","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]

Document Information

Modified date:
07 December 2021

UID

ibm10873162

Page Feedback