{"id":6217,"date":"2020-04-23T13:45:00","date_gmt":"2020-04-23T13:45:00","guid":{"rendered":"https:\/\/icrowdnewswire.com\/?p=2526895"},"modified":"2020-04-23T13:45:00","modified_gmt":"2020-04-23T13:45:00","slug":"security-bugs-bite-ibms-data-risk-manager","status":"publish","type":"post","link":"https:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/","title":{"rendered":"Security bugs bite IBM\u2019s Data Risk Manager"},"content":{"rendered":"

\"Security<\/h2>\n

Rejected researcher’s bug report.<\/h2>\n
\n

IBM has acknowledged three out of four serious vulnerabilities in its Data Risk Manager Linux virtual appliance, after initially rejecting a researcher’s bug report coordinated through the United States Computer Emergency Response Team (CERT).<\/p>\n

Pedro Ribeiro of Agile Information Security disclosed four vulnerabilities<\/a> to IBM, three of which can be chained together to achieve unauthenticated remote code execution with the rights of the root superuser that has full system access.<\/p>\n

The vulnerabilities disclosed by Ribeiro cover authentication bypass; command injection; Data Risk Manager having a default and insecure password; and attackers being able to arbitrarily download files.<\/p>\n

IBM’s response to the bug report was to close it, with the company initially saying it was “out of scope for our vulnerability disclosure program since this product is only for “enhanced” support paid for by our customers.”<\/p>\n

“This is an unbelievable response by IBM, a multi billion dollar company that is selling security enterprise products and security consultancy to huge corporations worldwide,” Ribeiro wrote.<\/p>\n

IBM has since advised<\/a> users to upgrade to version 2.0.6 of Data Risk Manager, but this does not appear to take care of the authentication bypass vulnerability, which the IT giant said is currently being investigated.<\/p>\n

Ribeiro believes that Data Risk Manager 2.0.4 to 2.0.6 are likely to be vulnerable to all the bugs he discovered, despite IBM’s claims to the opposite, as the new version was released before his disclosure report to the company.<\/p>\n

IBM Data Risk Manager is an enterprise security product that handles very sensitive information, Ribeiro noted.<\/p>\n

It stores credentials to access other security tools, and if an appliance was hacked, it could lead to a full scale company compromise, Ribeiro speculated.<\/p>\n

Ribeiro remains unconvinced that IBM will fix the vulnerabilities.<\/p>\n

“IBM refused to acknowledge this vulnerability report, so most likely won’t fix this vulnerability. Make sure you uninstall the product so it does not endanger your network \/ company,” he advised.<\/p>\n<\/div>\n

\n

See Campaign: <\/strong>https:\/\/github.com\/pedrib\/PoC\/blob\/master\/advisories\/IBM\/ibm_drm\/ibm_drm_rce.md<\/a>
Contact Information:<\/b>
Juha Saarinen<\/p>\n

Tags:<\/b>
<\/a>, Wire<\/a>, United States<\/a>, English<\/a><\/p>\n

\"image\"<\/div>\n

\n

Contact Information:<\/h3>\n

Juha Saarinen<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Rejected researcher’s bug report. IBM has acknowledged three out of four serious vulnerabilities in its Data Risk Manager Linux virtual appliance, after initially rejecting a researcher’s bug report coordinated through the United States Computer Emergency Response Team (CERT). Pedro Ribeiro of Agile Information Security disclosed four vulnerabilities to IBM, three of which can be chained together to … Continue reading Security bugs bite IBM’s Data Risk Manager<\/span><\/a> Continue Reading →<\/span><\/a><\/p>\n","protected":false},"author":19,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,22,54],"tags":[],"class_list":["post-6217","post","type-post","status-publish","format-standard","hentry","category-english","category-united-states","category-wire"],"yoast_head":"\nSecurity bugs bite IBM\u2019s Data Risk Manager - Business<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security bugs bite IBM\u2019s Data Risk Manager - Business\" \/>\n<meta property=\"og:description\" content=\"Rejected researcher’s bug report. IBM has acknowledged three out of four serious vulnerabilities in its Data Risk Manager Linux virtual appliance, after initially rejecting a researcher’s bug report coordinated through the United States Computer Emergency Response Team (CERT). Pedro Ribeiro of Agile Information Security disclosed four vulnerabilities to IBM, three of which can be chained together to … Continue reading Security bugs bite IBM’s Data Risk Manager Continue Reading →\" \/>\n<meta property=\"og:url\" content=\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/\" \/>\n<meta property=\"og:site_name\" content=\"Business\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-23T13:45:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1\" \/>\n<meta name=\"author\" content=\"Aneesa\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aneesa\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/\",\"url\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/\",\"name\":\"Security bugs bite IBM\u2019s Data Risk Manager - Business\",\"isPartOf\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage\"},\"image\":{\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1\",\"datePublished\":\"2020-04-23T13:45:00+00:00\",\"author\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/cee3758d3201f95199de3522858ca7e2\"},\"breadcrumb\":{\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage\",\"url\":\"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1\",\"contentUrl\":\"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ipsnews.net\/business\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security bugs bite IBM\u2019s Data Risk Manager\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ipsnews.net\/business\/#website\",\"url\":\"https:\/\/ipsnews.net\/business\/\",\"name\":\"Business\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ipsnews.net\/business\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/cee3758d3201f95199de3522858ca7e2\",\"name\":\"Aneesa\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5635ace541744f4e232d93d2fafa63d478ed1fd5c863cbc1484fc2148961368f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5635ace541744f4e232d93d2fafa63d478ed1fd5c863cbc1484fc2148961368f?s=96&d=mm&r=g\",\"caption\":\"Aneesa\"},\"sameAs\":[\"https:\/\/icrowdnewswire.com\/fc\"],\"url\":\"https:\/\/ipsnews.net\/business\/author\/aneesa\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security bugs bite IBM\u2019s Data Risk Manager - Business","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/","og_locale":"en_US","og_type":"article","og_title":"Security bugs bite IBM\u2019s Data Risk Manager - Business","og_description":"Rejected researcher’s bug report. IBM has acknowledged three out of four serious vulnerabilities in its Data Risk Manager Linux virtual appliance, after initially rejecting a researcher’s bug report coordinated through the United States Computer Emergency Response Team (CERT). Pedro Ribeiro of Agile Information Security disclosed four vulnerabilities to IBM, three of which can be chained together to … Continue reading Security bugs bite IBM’s Data Risk Manager Continue Reading →","og_url":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/","og_site_name":"Business","article_published_time":"2020-04-23T13:45:00+00:00","og_image":[{"url":"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1","type":"","width":"","height":""}],"author":"Aneesa","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Aneesa","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/","url":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/","name":"Security bugs bite IBM\u2019s Data Risk Manager - Business","isPartOf":{"@id":"https:\/\/ipsnews.net\/business\/#website"},"primaryImageOfPage":{"@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage"},"image":{"@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage"},"thumbnailUrl":"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1","datePublished":"2020-04-23T13:45:00+00:00","author":{"@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/cee3758d3201f95199de3522858ca7e2"},"breadcrumb":{"@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#primaryimage","url":"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1","contentUrl":"https:\/\/i.nextmedia.com.au\/Utils\/ImageResizer.ashx?n=https%3a%2f%2fi.nextmedia.com.au%2fNews%2fvpn_risk.jpg&w=480&c=0&s=1"},{"@type":"BreadcrumbList","@id":"http:\/\/ipsnews.net\/business\/2020\/04\/23\/security-bugs-bite-ibms-data-risk-manager\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ipsnews.net\/business\/"},{"@type":"ListItem","position":2,"name":"Security bugs bite IBM\u2019s Data Risk Manager"}]},{"@type":"WebSite","@id":"https:\/\/ipsnews.net\/business\/#website","url":"https:\/\/ipsnews.net\/business\/","name":"Business","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ipsnews.net\/business\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/cee3758d3201f95199de3522858ca7e2","name":"Aneesa","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5635ace541744f4e232d93d2fafa63d478ed1fd5c863cbc1484fc2148961368f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5635ace541744f4e232d93d2fafa63d478ed1fd5c863cbc1484fc2148961368f?s=96&d=mm&r=g","caption":"Aneesa"},"sameAs":["https:\/\/icrowdnewswire.com\/fc"],"url":"https:\/\/ipsnews.net\/business\/author\/aneesa\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/6217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/comments?post=6217"}],"version-history":[{"count":1,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/6217\/revisions"}],"predecessor-version":[{"id":6218,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/6217\/revisions\/6218"}],"wp:attachment":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/media?parent=6217"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/categories?post=6217"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/tags?post=6217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}