www.ibm.com Open in urlscan Pro
2600:141b:13:7a6::1e89  Public Scan

Form analysis
3 forms found in the DOM

POST /support/pages/node/6602289

<form action="/support/pages/node/6602289" method="post" id="openid-connect-login-form" accept-charset="UTF-8">
  <div><input data-drupal-selector="edit-openid-connect-client-generic-login" type="submit" id="edit-openid-connect-client-generic-login" name="generic" value="Log in with Generic" class="button js-form-submit form-submit">
  </div><input autocomplete="off" data-drupal-selector="form-2cc4oeui91hmkvvxs90q9acnldv3d2d5iwb6zdz31nc" type="hidden" name="form_build_id" value="form-2Cc4oEUi91HmKvvXS90q9AcnldV3d2D5Iwb6zDZ31Nc">
  <input data-drupal-selector="edit-openid-connect-login-form" type="hidden" name="form_id" value="openid_connect_login_form">
</form>

<form class="ibm-row-form ibm-home-search ibm" enctype="multipart/form-data" id="spng-search" ng-submit="omniType()">
  <input id="spng-search-query" class="bx--search-input" name="text" size="40" type="search" autocomplete="off" placeholder="Search support or find a product">
  <a title="Search" aria-label="Search" href="#" tabindex="-1" id="spng-search-button" ng-click="omniButton()" class="ibm-search-link common-search-link"></a>
  <div id="spng-search-typeahead-wrapper" style="display:none" class="search-results-wrapper">
    <div id="spng-search-typeahead" class="common-search-results">
      <div id="spng-spinner" style="display:none">
        <h2 class="ibm-h2 ibm-h4 ibm-bold"><span class="ibm-spinner">&nbsp;</span></h2>
      </div>
      <div id="sp-no-results" style="display:none">
        <div class="results">
          <p>No results were found for your search query.</p>
          <div class="ibm-rule">
            <hr>
          </div>
          <h5 class="ibm-h5"><strong>Tips</strong></h5>
          <p>To return expected results, you can:</p>
          <ul>
            <li><strong>Reduce the number of search terms.</strong> Each term you use focuses the search further.</li>
            <li><strong>Check your spelling.</strong> A single misspelled or incorrectly typed term can change your result.</li>
            <li><strong>Try substituting synonyms for your original terms.</strong> For example, instead of searching for "java classes", try "java training"</li>
            <li><strong>Did you search for an IBM acquired or sold product ?</strong> If so, follow the appropriate link below to find the content you need.</li>
          </ul>
        </div>
      </div>
      <div id="sp-doc-failure" style="display:none">
        <div class="category">Our apologies</div>
        <div class="results">
          <p>Search results are not available at this time. Please try again later or use one of the other support options on this page.</p>
        </div>
      </div>
      <div id="sp-prev-products" class="result_section"></div>
      <div id="sp-wd-results" class="result_section"></div>
      <div id="sp-prod-results" class="result_section"></div>
      <div id="sp-doc-results" class="result_section"></div>
    </div>
  </div>
</form>

POST /support/pages/node/6602289

<form class="node-security-bulletin-6602289-vote-field-was-this-topic-helpful__vote-vote-votingapi-useful-form vote-form" id="vote-form"
  data-drupal-selector="node-security-bulletin-6602289-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" action="/support/pages/node/6602289" method="post" accept-charset="UTF-8">
  <div class="js-form-item form-item js-form-type-select form-type-select js-form-item-value form-item-value form-no-label">
    <select autocomplete="off" data-result-value="-1" data-vote-value="-1" data-style="default" data-show-own-vote="false" data-drupal-selector="edit-value" id="edit-value" name="value" class="form-select select2-widget ibm-widget-processed"
      data-jquery-once-autocomplete="true" data-select2-autocomplete-list-widget="true" search-pagesize="10" style="display: none; width: 124px;" tabindex="0" aria-hidden="false">
      <option value="-1">Not useful</option>
      <option value="1">Useful</option>
    </select>
    <div class="useful-rating" role="complementary" aria-label="Was this topic helpful?">
      <div class="like">
        <a href="#"><button aria-label="Yes" tabindex="0" class="ibm-margin-right-1 bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M26,12H20V6a3.0033,3.0033,0,0,0-3-3H14.8672a2.0094,2.0094,0,0,0-1.98,1.7173l-.8453,5.9165L8.4648,16H2V30H23a7.0078,7.0078,0,0,0,7-7V16A4.0045,4.0045,0,0,0,26,12ZM8,28H4V18H8Zm20-5a5.0057,5.0057,0,0,1-5,5H10V17.3027l3.9578-5.9365L14.8672,5H17a1.0008,1.0008,0,0,1,1,1v8h8a2.0025,2.0025,0,0,1,2,2Z"></path></svg><span class="text-yes">Yes</span><span id="like" style="display:none;">999</span></button></a>
      </div>
      <div class="dislike">
        <a href="#"><button aria-label="No" tabindex="0" class="bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M30,16V9a7.0078,7.0078,0,0,0-7-7H2V16H8.4648l3.5774,5.3662.8453,5.9165A2.0094,2.0094,0,0,0,14.8672,29H17a3.0033,3.0033,0,0,0,3-3V20h6A4.0045,4.0045,0,0,0,30,16ZM8,14H4V4H8Zm20,2a2.0025,2.0025,0,0,1-2,2H18v8a1.0008,1.0008,0,0,1-1,1H14.8672l-.9094-6.3662L10,14.6973V4H23a5.0057,5.0057,0,0,1,5,5Z"></path></svg><span class="text-no">No</span><span id="dislike" style="display:none;">No</span></button></a>
      </div>
    </div>
  </div>
  <input autocomplete="off" data-drupal-selector="form-uwnjvecudcz0fpuxlw179jkjlc5oe8fgsq9hjfsucrm" type="hidden" name="form_build_id" value="form-uwnJVEcuDcZ0fPuXLW179JKJlC5OE8fGsq9HJFsuCrM">
  <input data-drupal-selector="edit-node-security-bulletin-6602289-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" type="hidden" name="form_id"
    value="node_security_bulletin_6602289_vote_field_was_this_topic_helpful__vote_vote_votingapi_useful_form">
  <input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Save" class="button button--primary js-form-submit form-submit" data-once="drupal-ajax" style="display: none;">
</form>

Text Content

Support My IBM Log in

IBM Support


 

No results were found for your search query.

--------------------------------------------------------------------------------

TIPS

To return expected results, you can:

 * Reduce the number of search terms. Each term you use focuses the search
   further.
 * Check your spelling. A single misspelled or incorrectly typed term can change
   your result.
 * Try substituting synonyms for your original terms. For example, instead of
   searching for "java classes", try "java training"
 * Did you search for an IBM acquired or sold product ? If so, follow the
   appropriate link below to find the content you need.

Our apologies

Search results are not available at this time. Please try again later or use one
of the other support options on this page.







SECURITY BULLETIN: MULTIPLE VULNERABILITIES IN OPENSSL AFFECT IBM TIVOLI NETCOOL
SYSTEM SERVICE MONITORS/APPLICATION SERVICE MONITORS


SECURITY BULLETIN





SUMMARY

There are multiple vulnerabilities in OpenSSL which is used by IBM Tivoli
Netcool System Service Monitors/Application Service Monitors


VULNERABILITY DETAILS

CVEID:   CVE-2022-0778
DESCRIPTION:   OpenSSL is vulnerable to a denial of service, caused by a flaw in
the BN_mod_sqrt() function when parsing certificates. By using a
specially-crafted certificate with invalid explicit curve parameters, a remote
attacker could exploit this vulnerability to cause an infinite loop, and results
in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/221911 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2022-1434
DESCRIPTION:   OpenSSL is vulnerable to a man-in-the-middle attack, caused by
the use of the AAD data as the MAC key in the RC4-MD5 ciphersuite. A remote
attacker could exploit this vulnerability to predict the MAC key and launch a
man-in-the-middle attack and gain access to the communication channel between
endpoints to modify data in transit in such a way that it will pass a MAC
integrity check.
CVSS Base score: 6.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/225617 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2022-1343
DESCRIPTION:   OpenSSL could allow a remote attacker to bypass security
restrictions, caused by a incorrect verification of response signing
certificates by the OCSP_basic_verify function. By sending a specially-crafted
request using the OCSP_NOCHECKS flag, an attacker could exploit this
vulnerability to forge positive verification results.
CVSS Base score: 5.3
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/225618 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2022-1292
DESCRIPTION:   OpenSSL could allow a remote authenticated attacker to execute
arbitrary commands on the system, caused by improper validation of user-supplied
input by the c_rehash script. By sending a specially-crafted request using shell
metacharacters, an attacker could exploit this vulnerability to execute
arbitrary commands with the privileges of the script on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/225619 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID:   CVE-2022-1473
DESCRIPTION:   OpenSSL is vulnerable to a denial of service, caused by a
resource leakage when decoding certificates and keys by the OPENSSL_LH_flush()
function. By sending a specially-crafted request, a remote attacker could
exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/225616 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2021-4160
DESCRIPTION:   OpenSSL could provide weaker than expected security, caused by a
carry propagation flaw in the MIPS32 and MIPS64 squaring procedure. An attacker
could exploit this vulnerability to launch further attacks on the system
CVSS Base score: 6.7
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/218394 for the current
score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)


AFFECTED PRODUCTS AND VERSIONS



Affected Product(s)Version(s)IBM Tivoli Netcool System Service
Monitors/Application Service Monitors4.0.1



REMEDIATION/FIXES

 

 ProductVMRFAPARRemediation/First FixIBM Tivoli Netcool System Service
Monitors/Application Service Monitors4.0.1 SP09PSIRTs
Onlyhttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/Netcool+System+Service+Monitor&release=4.0.1.3&platform=All&function=fixId&fixids=4.0.1.3-TIV-SSM-IF0009&includeSupersedes=0&source=fc



WORKAROUNDS AND MITIGATIONS

None


GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS

Subscribe to My Notifications to be notified of important product support alerts
like this.


REFERENCES

Complete CVSS v3 Guide
On-line Calculator v3

Off



RELATED INFORMATION

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog





CHANGE HISTORY

17 Jun 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately
impact the Overall CVSS Score. Customers can evaluate the impact of this
vulnerability in their environments by accessing the links in the Reference
section of this Security Bulletin.


DISCLAIMER

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY
ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to
address potential vulnerabilities, IBM periodically updates the record of
components contained in our product offerings. As part of that effort, if IBM
identifies previously unidentified packages in a product/service inventory, we
address relevant vulnerabilities regardless of CVE date. Inclusion of an older
CVEID does not demonstrate that the referenced product has been used by IBM
since that date, nor that IBM was aware of a vulnerability as of that date. We
are making clients aware of relevant vulnerabilities as we become aware of them.
"Affected Products and Versions" referenced in IBM Security Bulletins are
intended to be only products and versions that are supported by IBM and have not
passed their end-of-support or warranty date. Thus, failure to reference
unsupported or extended-support products and versions in this Security Bulletin
does not constitute a determination by IBM that they are unaffected by the
vulnerability. Reference to one or more unsupported versions in this Security
Bulletin shall not create an obligation for IBM to provide fixes for any
unsupported or extended-support products or versions.


DOCUMENT LOCATION

Worldwide



[{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data
Platform"},"Product":{"code":"SSGNTH","label":"Netcool\/System Service
Monitor"},"Component":"","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"v4.0.1","Edition":""}]


WAS THIS TOPIC HELPFUL?

Not usefulUseful
Yes999
NoNo



DOCUMENT INFORMATION

More support for:
Netcool/System Service Monitor

Software version:
v4.0.1

Operating system(s):
Linux, Windows

Document number:
6602289

Modified date:
08 July 2022


UID

ibm16602289

Page Feedback

Close


SHARE YOUR FEEDBACK


NEED SUPPORT?

 * Submit feedback to IBM Support

 * 1-800-IBM-7378 (USA)

 * Directory of worldwide contacts

Top products & platforms Industries Artificial intelligence Blockchain Business
operations Cloud computing Data & Analytics Hybrid cloud IT infrastructure
Security Supply chain What is Hybrid Cloud? What is Artificial intelligence?
What is Cloud Computing? What is Kubernetes? What are Containers? What is
DevOps? What is Machine Learning? IBM Consulting Communities Developer education
Support - Download fixes, updates & drivers IBM Research Partner with us -
PartnerWorld Training - Courses Upcoming events & webinars Annual report Career
opportunities Corporate social responsibility Diversity & inclusion Industry
analyst reports Investor relations News & announcements Thought leadership
Security, privacy & trust About IBM LinkedIn Twitter Instagram Subscription
Center Contact IBM Privacy Terms of use Accessibility United States — English
Share your feedback


IBM web domains

ibm.com, ibm.dev, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net,
merge.com, micromedex.com, mobilebusinessinsights.com, promontory.com,
proveit.com, ptech.org, resource.com, s81c.com, securityintelligence.com,
skillsbuild.org, softlayer.com, storagecommunity.org, strongloop.com,
teacheradvisor.org, think-exchange.com, thoughtsoncloud.com, trusteer.com,
truven.com, truvenhealth.com, alphaevents.webcasts.com, betaevents.webcasts.com,
ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net,
ibmcloud.com, redhat.com, galasa.dev, blueworkslive.com, swiss-quantum.ch,
altoromutual.com, blueworkslive.cn, blueworkslive.com, cloudant.com, ibm.ie,
ibm.fr, ibm.com.br, ibm.co, ibm.ca, silverpop.com,
community.watsonanalytics.com, eclinicalos.com, datapower.com,
ibmmarketingcloud.com, thinkblogdach.com, truqua.com, my-invenio.com,
skills.yourlearning.ibm.com, bluewolf.com, asperasoft.com, instana.com,
taos.com, envizi.com
About cookies on this site Our websites require some cookies to function
properly (required). In addition, other cookies may be used with your consent to
analyze site usage, improve the user experience and for advertising. For more
information, please review your Cookie preferences  options and IBM’s privacy
statement. To provide a smooth navigation, your cookie preferences will be
shared across the IBM web domains listed here.

Accept all Required only

Cookie Preferences