====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN078
_____________________________________________________________________

DATE                : 18/02/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running IBM ServeRAID Manager.

=====================================================================
https://kb.cert.org/vuls/id/597809/
_____________________________________________________________________


IBM ServeRAID Manager exposes unauthenticated Java Remote Method
Invocation (RMI) service
Vulnerability Note VU#597809

Original Release Date: 2020-02-12 | Last Revised: 2020-02-13


Overview

IBM ServeRAID Manager version 9.30-17006 and prior exposes a Java RMI
that allows a remote, unauthenticated attacker to execute arbitrary code
on a vulnerable system.


Description

IBM ServeRAID Manager includes an embedded instance of Java version
1.4.2. Both ServeRAID Manager and Java 1.4.2 are no longer supported.
ServeRAID Manager uses a Java Remote Method Invocation (RMI) on port
34571/tcp that listens on all interfaces by default. ServeRAID Manager
runs with SYSTEM privileges on Microsoft Windows systems. An
unauthenticated attacker with network access can exploit the vulnerable
RMI interface to launch a remote class loader attack. This appears to be
an instance of CVE-2011-3556.

The ServeRAID product name is used for hardware and software components
variously owned and maintained by IBM, Lenovo, and other vendors. This
vulnerability applies to IBM ServeRAID Manager software and no products
or components from Lenovo or any other vendor.


Impact

An unauthenticated remote attacker can execute arbitrary code on a
vulnerable system, with SYSTEM privileges on Microsoft Windows.


Solution

ServeRAID Manager is no longer supported and we do not expect IBM to
release fixes.

Restrict access

Configure ServeRAID Manager to listen on specific network interfaces
(like localhost) or use a host-based firewall to restrict network access
to 34571/tcp.


Vendor Information


IBM Corporation

Notified:  November 07, 2019 Updated:  February 11, 2020

Statement Date:   July 26, 2019

Status
  Affected

Vendor Statement

The product team has reviewed further and determined this is unsupported
software with no plans to fix. We will be removing it from the web to
avoid future confusion.

Vendor Information

We are not aware of further vendor information regarding this
vulnerability.

Vendor References


https://www.ibm.com/support/pages/ibm-serveraid-application-cd-v930-17006-ibm-system-x-and-bladecenter


Lenovo

Notified:  June 06, 2019 Updated:  February 11, 2020

Status
  Not Affected
Vendor Statement

No statement is currently available from the vendor regarding this
vulnerability.

Vendor Information

We are not aware of further vendor information regarding this
vulnerability.

Addendum

Lenovo was never responsible for the IBM ServeRAID Manager software.

If you have feedback, comments, or additional information about this
vulnerability, please send us email.



CVSS Metrics

Group           Score      Vector
Base            10         AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal        9.5        E:F/RL:U/RC:C
Environmental   2.4        CDP:ND/TD:L/CR:ND/IR:ND/AR:ND


References


https://www.ibm.com/support/pages/ibm-serveraid-application-cd-v930-17006-ibm-system-x-and-bladecenter
    https://www.ibm.com/support/pages/node/827256
    https://www.oracle.com/technetwork/java/javase/index-jsp-138567.html


Acknowledgements

Thanks to Brendan Saulsbury, Ariel Montano Cardenas, Lavelle Perry, and
Swagat Das for reporting this vulnerability.

This document was written by Laurie Tyzenhaus.


Other Information

CVE IDs:                CVE-2011-3556
Date Public:            2020-02-12
Date First Published:   2020-02-12
Date Last Updated:      2020-02-13 12:33 UTC
Document Revision:      54


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================