IBM PowerVC CVE-2015-1937 Authentication Bypass Vulnerability

Bugtraq ID:	74911
Class:	Design Error
CVE:	CVE-2015-1937
Remote:	Yes
Local:	No
Published:	May 28 2015 12:00AM
Updated:	May 28 2015 12:00AM
Credit:	IBM
Vulnerable:	IBM PowerVC Standard Edition 1.2.1 1 IBM PowerVC Standard Edition 1.2.2.2 IBM PowerVC Standard Edition 1.2.2.1 IBM PowerVC Standard Edition 1.2.2 IBM PowerVC Standard Edition 1.2.1.2 IBM PowerVC Standard Edition 1.2.1.0 IBM PowerVC Standard Edition 1.2.0.4 IBM PowerVC Standard Edition 1.2.0.3 IBM PowerVC Standard Edition 1.2.0.2 IBM PowerVC Standard Edition 1.2.0.1 IBM PowerVC Standard Edition 1.2.0.0 IBM PowerVC Express Edition 1.2.1 1 IBM PowerVC Express Edition 1.2.1.2 IBM PowerVC Express Edition 1.2.0.4 IBM PowerVC Express Edition 1.2.0.3 IBM PowerVC Express Edition 1.2.0.2 IBM PowerVC Express Edition 1.2.0.1 IBM PowerVC Express Edition 1.2.0.0
Not Vulnerable:

IBM PowerVC CVE-2015-1937 Authentication Bypass Vulnerability

IBM PowerVC is prone to a authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks.

IBM PowerVC CVE-2015-1937 Authentication Bypass Vulnerability

Currently, we are not aware of any publicly available exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

IBM PowerVC CVE-2015-1937 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM PowerVC CVE-2015-1937 Authentication Bypass Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM PowerVC �?? Virtualization Center Homepage (IBM)
  
• Security Bulletin: Ceilometer database access unrestricted in PowerVC (CVE-2015- (IBM)