IBM Security Verify Access Appliance denial of service

Vulnerability

IBM Security Verify Access Appliance versions 10.0.0 through 10.0.7 contain a vulnerability where uninitialized variables are used during the deployment process [1]. This flaw exists in the deployment scripts and can be triggered by a local user.

Exploitation

An attacker with local access to the appliance can exploit this by triggering the deployment functionality that uses uninitialized variables. No authentication is required for the local user to cause the issue, as per the CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) [1].

Impact

Successful exploitation leads to a denial of service (DoS) condition, impacting the availability of the appliance. There is no impact on confidentiality or integrity [1].

Mitigation

IBM has addressed this vulnerability in the public GitHub repository of deployment scripts. Users should update to the latest version of the scripts from the repository [1]. The specific fixed version is not explicitly stated in the reference, but the bulletin indicates the vulnerabilities have been addressed. No workaround is provided.