3 ms·

Multiple Vulnerabilities in IBM Data Risk Manager

88 points by Daviey 7y ago

teepo 7y ago
According to IBM this is not even an active product [1]. Although after some reading it does appear that if a client was still using this solution and was paying for extended support that IBM would take care of them. I wonder if the security researcher knows if this is a COTS product. I could not find it to download, isn't generally available, and appears to be deprecated by IBMs more cloud centric security solutions [1]https://www.ibm.com/support/lifecycle/#/details?q45=I355654S22480A00 https://www.ibm.com/support/lifecycle/#/details?q45=I355654S...
- phonon 7y ago
  Wrong version, newer versions are still supported. https://www.ibm.com/support/lifecycle/#/details?q45=U977729P09903E32 https://www.ibm.com/support/lifecycle/#/details?q45=U977729P...
phonon 7y ago
This appears to be IBM's response. https://www.ibm.com/support/pages/ibm-data-risk-manager-vulnerabilities https://www.ibm.com/support/pages/ibm-data-risk-manager-vuln...
reader_1000 7y ago
The way IBM handles this is pretty bad. No company, especially the ones selling a security product, should ignore security researchers reports and feedbacks Also the bugs described in article are quite surprising since for a IBM-sized company, you expect them to have solid authentication/authorization framework which they use for all their products. Is this a acquired product? Authentication mechanism is very unusual. Why would anyone save a session id coming from the user? This is more than trusting user input, I think. Also ../../etc/passwd attack is a kind of vulnerability that almost every automated vulnerabilty scanner scans. Most people assume that authenticated pages do not need that much security precautions however as articles shows, when combined with authentication bypass vulnerabilities, you basically give keys of your systems to the attacker.
- osipov 7y ago
  >you expect them to have solid authentication/authorization framework which they use for all their products haha
jbob2000 7y ago
The thing about enterprise services is that they don't operate in the same environment as ones on the open internet. So while these vulnerabilities look bad on their own, they aren't that bad when you stack the enterprise's other security services and processes on top.

88 points by Daviey 7y ago

According to IBM this is not even an active product [1]. Although after some reading it does appear that if a client was still using this solution and was paying for extended support that IBM would take care of them. I wonder if the security researcher knows if this is a COTS product. I could not find it to download, isn't generally available, and appears to be deprecated by IBMs more cloud centric security solutions [1]https://www.ibm.com/support/lifecycle/#/details?q45=I355654S22480A00 https://www.ibm.com/support/lifecycle/#/details?q45=I355654S...

phonon 7y ago
Wrong version, newer versions are still supported. https://www.ibm.com/support/lifecycle/#/details?q45=U977729P09903E32 https://www.ibm.com/support/lifecycle/#/details?q45=U977729P...

phonon 7y ago

This appears to be IBM's response. https://www.ibm.com/support/pages/ibm-data-risk-manager-vulnerabilities https://www.ibm.com/support/pages/ibm-data-risk-manager-vuln...

reader_1000 7y ago

The way IBM handles this is pretty bad. No company, especially the ones selling a security product, should ignore security researchers reports and feedbacks Also the bugs described in article are quite surprising since for a IBM-sized company, you expect them to have solid authentication/authorization framework which they use for all their products. Is this a acquired product? Authentication mechanism is very unusual. Why would anyone save a session id coming from the user? This is more than trusting user input, I think. Also ../../etc/passwd attack is a kind of vulnerability that almost every automated vulnerabilty scanner scans. Most people assume that authenticated pages do not need that much security precautions however as articles shows, when combined with authentication bypass vulnerabilities, you basically give keys of your systems to the attacker.

osipov 7y ago
>you expect them to have solid authentication/authorization framework which they use for all their products haha

jbob2000 7y ago

The thing about enterprise services is that they don't operate in the same environment as ones on the open internet. So while these vulnerabilities look bad on their own, they aren't that bad when you stack the enterprise's other security services and processes on top.