IBM Security Access Manager Container denial of service

Vulnerability

IBM Security Access Manager Container (IBM Security Verify Access Appliance and Docker) versions 10.0.0.0 through 10.0.6.1 are vulnerable to a denial of service (DoS) attack on the DSC server. The vulnerability occurs due to improper handling of network requests, allowing an attacker to cause service disruption.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted network traffic to the DSC server. No authentication is required, and the attack can be launched remotely. The attacker does not need prior access or special privileges.

Impact

Successful exploitation leads to a denial of service condition on the DSC server, potentially causing authentication services to become unavailable. This impacts the availability of the system, disrupting normal operations.

Mitigation

IBM has released updates to address this vulnerability. Users should upgrade to IBM Security Verify Access Appliance and Docker versions later than 10.0.6.1 as specified in the security bulletin [1]. No workarounds are documented.