Vulnerability CVE-2018-1447
Published: 2018-04-04

Description:
The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

Type:

CWE-916

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
IBM -> Spectrum protect for virtual environments 

 References:
http://www.ibm.com/support/docview.wss?uid=swg22014669
http://www.ibm.com/support/docview.wss?uid=swg22014957
http://www.ibm.com/support/docview.wss?uid=swg22015066
http://www.ibm.com/support/docview.wss?uid=swg22015071
http://www.securityfocus.com/bid/104511
http://www.securitytracker.com/id/1041012
https://exchange.xforce.ibmcloud.com/vulnerabilities/139972
Copyright 2024, cxsecurity.com

 

Back to Top