Vulnerability Description
The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Spectrum Protect For Space Management | >= 7.1.0.0, <= 7.1.8.1 |
| Ibm | Spectrum Protect For Virtual Environments | >= 7.1.0.0, <= 7.1.8.0 |
| Ibm | Spectrum Protect Snapshot | >= 4.1.0.0, <= 4.1.6.3 |
Related Weaknesses (CWE)
References
- http://www.ibm.com/support/docview.wss?uid=swg22014669PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22014957PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22015066PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22015071PatchVendor Advisory
- http://www.securityfocus.com/bid/104511
- http://www.securitytracker.com/id/1041012
- https://exchange.xforce.ibmcloud.com/vulnerabilities/139972VDB EntryVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22014669PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22014957PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22015066PatchVendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22015071PatchVendor Advisory
- http://www.securityfocus.com/bid/104511
- http://www.securitytracker.com/id/1041012
- https://exchange.xforce.ibmcloud.com/vulnerabilities/139972VDB EntryVendor Advisory
FAQ
What is CVE-2018-1447?
CVE-2018-1447 is a vulnerability with a CVSS score of 5.1 (MEDIUM). The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of p...
How severe is CVE-2018-1447?
CVE-2018-1447 has been rated MEDIUM with a CVSS base score of 5.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1447?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Spectrum Protect For Space Management, Ibm Spectrum Protect For Virtual Environments, Ibm Spectrum Protect Snapshot.