SB2025021476 - Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
Published: February 14, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2018-15919)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to insufficient validation of an authentication request packet when the Guide Star Server II (GSS2) component is used. A remote attacker can send an authentication request packet and access sensitive information, such as valid usernames.
2) User enumeration (CVE-ID: CVE-2018-15473)
The vulnerability allows a remote attacker to enumerate all accounts on the system.
The vulnerability exists due to a logical error in auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c files when processing authentication requests. A remote attacker can send a specially crafted chain of packets and monitor behavior of openssh server to determine presence of a valid username. The server will drop connection upon receiving a malformed authentication packets if the username is valid.
3) Denial of service (CVE-ID: CVE-2017-15906)
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.The weakness exists in the process_open() function due to improper prevention of write operations in read-only mode. A remote attacker can create zero-length files and cause the service to crash.
Successful exploitation of the vulnerability results in denial of service.
4) Null pointer dereference (CVE-ID: CVE-2016-10708)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to improper processing of out-of-sequence NEWKEYS messages, as defined in the kex.c and packet.c source code files. A remote attacker can send an out-of-sequence NEWKEYS message, trigger a NULL pointer dereference condition and cause the sshd daemon to crash.
5) Buffer overflow (CVE-ID: CVE-2016-10012)
The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.The vulnerability exists in sshd due to a flaw in boundary checks in the shared memory manager that may be skipped by some optimizing compilers. A local user can trigger memory corruption and execute arbitrary code with root privileges. The issue is related to m_zback and m_zlib data structures.
Successful exploitation of this vulnerability may allow a local user to elevate privileges.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-1483)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A local user can hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
Remediation
Install update from vendor's website.