IBM Security Access Manager denial of service

Vulnerability

IBM Security Access Manager Container, including IBM Security Verify Access Appliance and IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.6.1, is vulnerable to denial of service due to uncontrolled resource consumption. An attacker can exploit this by sending a high volume of requests, causing the system to exhaust resources such as memory or CPU, leading to service unavailability.

Exploitation

An attacker with network access to the affected system can send specially crafted requests that trigger uncontrolled resource consumption. No authentication is required, and the attack can be performed remotely. The continued sending of such requests can degrade performance and eventually cause a denial of service.

Impact

Successful exploitation results in a denial of service condition, making the IBM Security Verify Access service unavailable to legitimate users. This impacts the availability of the authentication and access management services.

Mitigation

IBM has released updates to address this vulnerability. Users should apply the latest fixes as indicated in the security bulletin [1]. If immediate patching is not possible, consider network-level restrictions to limit access to the affected systems.