Wednesday, October 16, 2024
HomeCVE/vulnerabilityFour IBM Zero-days Leaked Online After the Company Refused to Patch The...

Four IBM Zero-days Leaked Online After the Company Refused to Patch The Bugs

Published on

Malware protection

Security researcher Pedro Ribeiro, Director of Research at Agile Information Security disclosed four zero-day vulnerabilities on GitHub after the company refused to fix them and accept.

The vulnerabilities found with IBM Data Risk Manager (IDRM) enterprise security software, which helps business to uncover, analyze, and visualize data-related business risks.

Four IBM zero-days

While analyzing the IBM Data Risk Manager device researcher found four vulnerabilities, out of the three are critical and one at high risk.

- Advertisement - SIEM as a Service

Following are the vulnerabilities

  1. Authentication Bypass
  2. Command Injection
  3. Insecure Default Password
  4. Arbitrary File Download

The first three vulnerabilities chained by attackers allows achieving unauthenticated remote code execution as a root user.

“In addition, two Metasploit modules that bypass authentication and exploit the remote code execution and arbitrary file download are being released to the public,” he added.

Ribeiro confirmed the existence of the vulnerability with version 2.0.3 and he is unclear about the latest version 2.0.6.

“IDRM is an enterprise security product that handles very sensitive information. The hacking of an IDRM the appliance might lead to a full-scale company compromise, as it stores credentials to access other security tools.”

zero-day public Disclosure

IBM said that “we have assessed this report and closed as being out of scope for our vulnerability disclosure program since this product is only for “enhanced” support paid for by our customers.”

According to the policy outlined by IBM in https://hackerone.com/ibm, “to be eligible to participate in this program, you must not be under contract to perform security testing for IBM Corporation or an IBMthe subsidiary, or IBM client within 6 months prior to submitting a report.”

IDM said that “a process error resulted in an improper response to the researcher who reported this situation to IBM.”

By combining vulnerabilities #1, #2 and #3, an unauthenticated user can achieve remote code execution as root – Metasploit Module

If vulnerabilities #1 and #4 are combined, it’s possible for an unauthenticated attacker to download arbitrary files off the system – Metasploit Module.

Bugs Patched

IBM patched two vulnerabilities and working to analyze and identify additional fix actions as needed.

  1. Command Injection Vulnerability in version 2.0.1, 2.0.2 and 2.0.3 is addressed in version 2.0.4
  2. Arbitrary File Download identified in version 2.0.2 and 2.0.3 is addressed in version 2.0.4

To mitigate the vulnerabilities IBM recommended users to upgrade with IDRM version 2.0.6.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Multiple Vulnerabilities in IBM QRadar SIEM Allows Attackers to Escalate Privileges and to Execute Arbitrary Commands

IBM Announced that they Acquired Red Hat for $34 Billion

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...