SB2024081936 - Multiple vulnerabilities in IBM Netezza Performance Server
Published: August 19, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2018-0739)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to excessive stack memory consumption. A remote attacker can cause the service to crash.
2) Cryptographic issues (CVE-ID: CVE-2019-1547)
The vulnerability allows a remote attacker to decrypt traffic.
The vulnerability exists due to insufficient enforcement of side channel resistant code paths. A remote attacker with ability to create a large number of signatures, where explicit parameters with no co-factor is present, can force the application to fall back to non-side channel resistant code pathsduring ECDSA signature operation and perform full key recovery.
Successful exploitation of the vulnerability may allow an attacker to decrypt communication between server and client.
3) Improper input validation (CVE-ID: CVE-2017-3737)
The vulnerability allows a remote attacker to gain access to potentially sensitive information on the target system.The weakness exists due to an "error state mechanism" when SSL_read() or SSL_write() is called directly after SSL object. A remote attacker can a specially crafted input, trigger a fatal error during a handshake and return it in the initial function call to access or modify sensitive information.
Remediation
Install update from vendor's website.