SB2024070516 - Multiple vulnerabilities in IBM QRadar SIEM
Published: July 5, 2024 Updated: September 10, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22259)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
2) Resource exhaustion (CVE-ID: CVE-2023-4408)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing DNS messages. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) NULL pointer dereference (CVE-ID: CVE-2023-40546)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the mirror_one_esl() function in mok.c while creating a new ESL variable. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2023-40547)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing verification of data authenticity when parsing HTTP responses. A remote attacker can perform a man-in-the-middle (MitM) attack and use a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.
5) Integer overflow (CVE-ID: CVE-2023-40548)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the verify_sbat_section on 32-bits systems. A remote attacker can pass a specially crafted PE binary to the application, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Out-of-bounds read (CVE-ID: CVE-2023-40549)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the verify_buffer_authenticode() function when parsing PE binary. A remote attacker can pass a specially crafted PE binary to the loader, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
7) Out-of-bounds read (CVE-ID: CVE-2023-40550)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the verify_buffer_sbat() function. A remote attacker can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
8) Out-of-bounds read (CVE-ID: CVE-2023-40551)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition when parsing MZ binaries. A remote attacker can pass a specially crafted MZ binary to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
9) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22243)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
10) Race condition (CVE-ID: CVE-2023-3758)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a race condition where the GPO policy is not consistently applied for authenticated users. A remote user can exploit the race and gain unauthorized access to the system.
11) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22262)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
Note, this vulnerability exists due to incomplete fix for #VU87614 (CVE-2024-22259) and #VU86695 (CVE-2024-22243).
Remediation
Install update from vendor's website.