CVE-2018-1466 : IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSy

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.

Published 2018-05-17 21:29:01

Updated 2020-08-19 19:02:00

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2018-1466

IBM » Storwize V7000 Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V7000 » Version: N/A
IBM » Storwize V7000 Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V7000 » Version: N/A
IBM » Storwize V7000 Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V7000 » Version: N/A
IBM » Storwize V7000 Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V7000 » Version: N/A
IBM » Storwize V7000 Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V7000 » Version: N/A
IBM » Storwize V5000 Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V5000 » Version: N/A
IBM » Storwize V5000 Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V5000 » Version: N/A
IBM » Storwize V5000 Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V5000 » Version: N/A
IBM » Storwize V5000 Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V5000 » Version: N/A
IBM » Storwize V5000 Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V5000 » Version: N/A
IBM » San Volume Controller Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » San Volume Controller » Version: N/A
IBM » San Volume Controller Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » San Volume Controller » Version: N/A
IBM » San Volume Controller Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » San Volume Controller » Version: N/A
IBM » San Volume Controller Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » San Volume Controller » Version: N/A
IBM » San Volume Controller Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » San Volume Controller » Version: N/A
IBM » Storwize V3700 Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3700 » Version: N/A
IBM » Storwize V3700 Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3700 » Version: N/A
IBM » Storwize V3700 Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3700 » Version: N/A
IBM » Storwize V3700 Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3700 » Version: N/A
IBM » Storwize V3700 Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3700 » Version: N/A
IBM » Storwize V3500 Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3500 » Version: N/A
IBM » Storwize V3500 Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3500 » Version: N/A
IBM » Storwize V3500 Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3500 » Version: N/A
IBM » Storwize V3500 Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3500 » Version: N/A
IBM » Storwize V3500 Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V3500 » Version: N/A
IBM » Storwize V9000 Firmware
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V9000 » Version: N/A
IBM » Storwize V9000 Firmware
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V9000 » Version: N/A
IBM » Storwize V9000 Firmware
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V9000 » Version: N/A
IBM » Storwize V9000 Firmware
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V9000 » Version: N/A
IBM » Storwize V9000 Firmware
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Storwize V9000 » Version: N/A
IBM » Spectrum Virtualize
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize For Public Cloud
Versions from including (>=) 7.7.0.0 and before (<) 7.7.1.9
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize For Public Cloud
Versions from including (>=) 6.1.0.0 and before (<) 7.5.0.14
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize For Public Cloud
Versions from including (>=) 8.1.2.0 and before (<) 8.1.2.1
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize For Public Cloud
Versions from including (>=) 8.1.1.0 and before (<) 8.1.1.2
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Virtualize For Public Cloud
Versions from including (>=) 7.8.0.0 and before (<) 7.8.1.6
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-1466

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1466

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	1.6	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-1466

CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1466

http://www.ibm.com/support/docview.wss?uid=ssg1S1012263

IBM Security Bulletin: Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
Vendor Advisory

CVEs referencing this url
http://www.ibm.com/support/docview.wss?uid=ssg1S1012283

IBM Security Bulletin: Multiple vulnerabilities affect the IBM FlashSystem model V840
Vendor Advisory

CVEs referencing this url
http://www.ibm.com/support/docview.wss?uid=ssg1S1012282

IBM Security Bulletin: Multiple vulnerabilities affect the IBM FlashSystem models 840 and 900
Vendor Advisory

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/140397

IBM Storwize information disclosure CVE-2018-1466 Vulnerability Report
VDB Entry;Vendor Advisory
http://www.securityfocus.com/bid/104349

Multiple IBM Products Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-1466

Products affected by CVE-2018-1466

Exploit prediction scoring system (EPSS) score for CVE-2018-1466

CVSS scores for CVE-2018-1466

CWE ids for CVE-2018-1466

References for CVE-2018-1466