IBM Storage Virtualize IKEv1 Implementation Information Disclosure Vulnerability

An information disclosure vulnerability has been identified in the IKEv1 implementation of IBM Storage Virtualize versions 8.4, 8.5, 8.7, and 9.1. This vulnerability allows remote attackers to access sensitive information from the device memory by sending a Security Association (SA) negotiation request.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information stored in the device memory.

Remediation

Users are advised to upgrade to version 8.4.0.10, 8.5.0.7, 8.7.0.8, or 9.1.0.2. Instructions for downloading the latest code for IBM SAN Volume Controller, IBM Storwize V7000, V5000, V5100, V5000E, IBM FlashSystem 5000, 5100, 5200, 5300, 7200, 7300, 9100, 9200, 9500, and IBM Storage Virtualize for Public Cloud are available on the IBM Support Fix Central website.