Multiple Vulnerabilities Discovered in IBM Security Network Intrusion Prevention System Sensors

ITS Advisory Number: 
2014-076
Date(s) Issued: 
Tuesday, September 9, 2014
Subject: 
Multiple Vulnerabilities Discovered in IBM Security Network Intrusion Prevention System Sensors
Overview: 

Multiple vulnerabilities have been discovered in IBM's Security Network Intrusion Prevention System (IPS) sensors. These system sensors are components of the IPS and are strategically positioned on the network to help detect and stop anomalous, undesirable traffic.

Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user, or gaining session authentication credentials. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

Systems Affected: 
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.3
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.4
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.5
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.6
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.6.1
  • IBM Security Network Intrusion Prevention System GX Sensors firmware 4.6.2
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
High
BUSINESS
Large and medium business entities: 
High
Small business entities: 
Low
Home Users: 
N/A
Description: 

Multiple security vulnerabilities have been discovered in curl and php5 that are used with the IBM Security Network Intrusion Prevention System GX sensors with firmware 4.x. Details of the vulnerabilities are as follows:

  • cURL/libcURL is vulnerable to a heap-based buffer overflow caused by improper bounds checking by the curl_easy_unescape() function in lib/escape.c. While decoding URL encoded strings to raw binary data, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. (CVE-2013-2174)
  • libcURL could allow a remote attacker from within the local network to bypass security restrictions caused by the re-use of recently authenticated connections. By sending a new NTLM-authenticated request, an attacker could exploit this vulnerability to perform unauthorized actions with the privileges of the victim. (CVE-2014-0015)
  • cURL/libcURL could allow a remote attacker to bypass security restrictions caused by the re-use of previously used connections when processing new requests. An attacker could exploit this vulnerability to hijack the privileges of a different user's session and launch further attacks on the system. (CVE-2014-0138)
  • cURL/libcURL could allow a remote attacker to bypass security restrictions caused by an error in the hostmatch() function when validating certificates containing an IP address with a wildcard match within the Common Name field. By sending a specially-crafted SSL certificate containing wildcard characters, a remote attacker could exploit this vulnerability to spoof the server and launch further attacks on the system. (CVE-2014-0139)
  • PHP could allow a remote attacker to conduct spoofing attacks caused by an error when handling certificates that contain hostnames with NULL bytes. By persuading a victim to visit a Web site containing a specially-crafted certificate, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to spoof SSL servers. (CVE-2013-4248)
  • PHP could allow a remote attacker to execute arbitrary code on the system caused by an error in the asn1_time_to_time_t() function when parsing X.509 certificates. An attacker could exploit this vulnerability using a specially-crafted X.509 certificate to corrupt memory and execute arbitrary code on the system. (CVE-2013-6420)
  • LibGD is vulnerable to a denial of service caused by a NULL pointer dereference in the gdImageCreateFromXpm function. A remote attacker could exploit this vulnerability to cause the application to crash. Note: This vulnerability also affects PHP. (CVE-2014-2497)
  • PHP is vulnerable to a heap-based buffer overflow caused by improper bounds checking by when parsing DNS TXT record. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. (CVE-2014-4049)
Actions: 

We recommend the following actions be taken:

  • Apply appropriate patches provided by IBM to affected systems immediately after appropriate testing
References: 
IBM: http://www-01.ibm.com/support/docview.wss?uid=swg21680826 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6420 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2497 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4049