SB2024021220 - Multiple vulnerabilities in IBM Cloud APM
Published: February 12, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-30431)
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A local attacker can create a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Out-of-bounds write (CVE-ID: CVE-2023-35012)
The vulnerability allows a remote privileged user to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. A remote privileged user can send a specially crafted file, trigger an out-of-bounds write and execute arbitrary code on the target system.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-27558)
The vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A local attacker can exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service.
4) Information disclosure (CVE-ID: CVE-2023-29256)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.
5) Resource exhaustion (CVE-ID: CVE-2023-30442)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Code Injection (CVE-ID: CVE-2023-27868)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to unchecked class instantiation when providing plugin classes. A remote user can send a specially crafted request using the named pluginClassName class and execute arbitrary code on the target system.
7) Code Injection (CVE-ID: CVE-2023-27867)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote user can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Code Injection (CVE-ID: CVE-2023-27869)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to unchecked logger injection. A remote user can send a specially crafted request using the named traceFile property and execute arbitrary code on the target system.
9) Insufficient Logging (CVE-ID: CVE-2023-23487)
The vulnerability allows a remote user to modify data on the system.
The vulnerability exists due to insufficient audit logging. A remote user can trigger the vulnerability to modify data on the system.
10) Resource exhaustion (CVE-ID: CVE-2023-30449)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
11) Resource exhaustion (CVE-ID: CVE-2023-30445)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send a specially crafted query on certain tables to trigger resource exhaustion and perform a denial of service (DoS) attack.
12) Resource exhaustion (CVE-ID: CVE-2023-30448)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send a specially crafted query on certain tables to trigger resource exhaustion and perform a denial of service (DoS) attack.
13) Resource exhaustion (CVE-ID: CVE-2023-30446)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send specially crafted query on certain tables to trigger resource exhaustion and perform a denial of service (DoS) attack.
14) Resource exhaustion (CVE-ID: CVE-2023-30447)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send a specially crafted query on certain tables to trigger resource exhaustion and perform a denial of service (DoS) attack.
15) Resource exhaustion (CVE-ID: CVE-2023-30443)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can send a specially crafted query on certain tables to trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.