Since the middle of the week, when we discussed a vulnerability in IBM DB2 in a Heisec alert, IBM has six new safety instructions on vulnerabilities "High"-Classification published. Affected are the products Netezza Host Management, Resilient, Spectrum Protect Plus and Spectrum Protect Extended Edition as TNPM Wireline. Some of the vulnerabilities are exported from afar and without authentication. The existing updates or workarounds should be played and implemented promptly.
In addition, new safety instructions are available "Low"- and "medium"-Weak points in different products; In addition, some old Advisories were added to new information. All Advisories are available from IBMS Product Security Incident Response Blog.
"High"-Vulnerabilities in the overview
The security problems in Netezza Photos on multiple Linux kernel vulnerabilities, which allows a local attacker to allow any program codes to vulnerable systems. Affected are Netezza versions from 22.214.171.124; For hedging, manual steps (blacklisting individual kernel modules) are required, the IBM in the advisory is excellent.
Also in the case of Spectrum Protect Plus is "external" Code, namely from Python 3.8th.4, responsible for vulnerabilities. Here, too, code execution was possible, among other things, by a local attacker – in Spectrum Protect Plus 10.1.6 on Windows. An update to version 10.1.7 But also secures Linux systems against attacks: A remote attacker had its right-wing access data thanks to HardGecodeter access data.
- IBM SPECTRUM PROTECT PLUS (CVE-2020-15801, Windows)
- IBM Spectrum Protect Plus (CVE-2020-4854, Linux)
In IBM Resilient Soar 38.0 Under Linux, an alter version of the IBM JDK was responsible for attacks from afar; An update to the resilient version 39.0 Moving JDK eliminates the problem. Cleaner information about these and the incur "High"-Vulnerabilities call the following safety instructions:
- IBM Resilient Soar (Linux)
- IBM Spectrum Protect Extended Edition (AIX, Linux, Windows)
- IBM TNPM Wireline (Linux, Aix, Solaris)