Security researcher Pedro Ribeiro, Director of Research at Agile Information Security disclosed four zero-day vulnerabilities on GitHub after the company refused to fix them and accept.
The vulnerabilities found with IBM Data Risk Manager (IDRM) enterprise security software, which helps business to uncover, analyze, and visualize data-related business risks.
While analyzing the IBM Data Risk Manager device researcher found four vulnerabilities, out of the three are critical and one at high risk.
Following are the vulnerabilities
The first three vulnerabilities chained by attackers allows achieving unauthenticated remote code execution as a root user.
“In addition, two Metasploit modules that bypass authentication and exploit the remote code execution and arbitrary file download are being released to the public,” he added.
Ribeiro confirmed the existence of the vulnerability with version 2.0.3 and he is unclear about the latest version 2.0.6.
“IDRM is an enterprise security product that handles very sensitive information. The hacking of an IDRM the appliance might lead to a full-scale company compromise, as it stores credentials to access other security tools.”
IBM said that “we have assessed this report and closed as being out of scope for our vulnerability disclosure program since this product is only for “enhanced” support paid for by our customers.”
According to the policy outlined by IBM in https://hackerone.com/ibm, “to be eligible to participate in this program, you must not be under contract to perform security testing for IBM Corporation or an IBMthe subsidiary, or IBM client within 6 months prior to submitting a report.”
IDM said that “a process error resulted in an improper response to the researcher who reported this situation to IBM.”
By combining vulnerabilities #1, #2 and #3, an unauthenticated user can achieve remote code execution as root – Metasploit Module
If vulnerabilities #1 and #4 are combined, it’s possible for an unauthenticated attacker to download arbitrary files off the system – Metasploit Module.
IBM patched two vulnerabilities and working to analyze and identify additional fix actions as needed.
To mitigate the vulnerabilities IBM recommended users to upgrade with IDRM version 2.0.6.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Also Read
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…