Vulnerability Note VU#512193
IBM Director fails to properly time-out connection requests from clients
IBM Director Systems, specifically CIM Server, contains a denial-of-service vulnerability that can allow a remote, unauthenticated attacker to render Director inoperative.
IBM Director is a suite of system management tools.
When a rogue connection request is made to IBM Director Systems, specifically the CIM Server, a thread is created that listens on a port, waiting for a specific response from the client. If the client does not send the expected response, the thread remains in memory listening, indicating a high CPU utilization until the client connects to it. If multiple rogue clients connect simultaneously, the finite number of connections can be exhausted causing server to crash.
IBM Director Systems will become inaccessible for management.
Apply an update
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|IBM eServer||Affected||15 Nov 2007||20 Nov 2007|
CVSS Metrics (Learn More)
Thanks to IBM for reporting this vulnerability, who in turn credit Juniper Networks.
This document was written by Will Dormann.
- CVE IDs: CVE-2007-5612
- Date Public: 20 Nov 2007
- Date First Published: 20 Nov 2007
- Date Last Updated: 20 Nov 2007
- Severity Metric: 0.91
- Document Revision: 5
If you have feedback, comments, or additional information about this vulnerability, please send us email.