search menu icon-carat-right cmu-wordmark

CERT Coordination Center

IBM Director fails to properly time-out connection requests from clients

Vulnerability Note VU#512193

Original Release Date: 2007-11-20 | Last Revised: 2007-11-20

Overview

IBM Director Systems, specifically CIM Server, contains a denial-of-service vulnerability that can allow a remote, unauthenticated attacker to render Director inoperative.

Description

IBM Director is a suite of system management tools.

When a rogue connection request is made to IBM Director Systems, specifically the CIM Server, a thread is created that listens on a port, waiting for a specific response from the client. If the client does not send the expected response, the thread remains in memory listening, indicating a high CPU utilization until the client connects to it. If multiple rogue clients connect simultaneously, the finite number of connections can be exhausted causing server to crash.

Versions 5.20.1 and earlier for Windows and Linux are affected.

Impact

IBM Director Systems will become inaccessible for management.

Solution

Apply an update

Download and Apply the patch for Windows and Linux systems here:
https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dmp


Block or restrict access

Employ other protection mechanisms that will restrict access to the Director Systems by installing firewalls, defining filters, or by using reverse proxies.

Vendor Information

512193
 

IBM eServer Affected

Notified:  November 15, 2007 Updated: November 20, 2007

Status

Affected

Vendor Statement

Download and Apply patch for Windows and Linux from here

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dmp

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to IBM for reporting this vulnerability, who in turn credit Juniper Networks.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2007-5612
Severity Metric: 0.91
Date Public: 2007-11-20
Date First Published: 2007-11-20
Date Last Updated: 2007-11-20 21:19 UTC
Document Revision: 5

Sponsored by CISA.