IBM DataPower Gateway Multiple Vulnerabilities Allow DoS and Data Manipulation

CERT-Bund identified multiple security vulnerabilities in IBM DataPower Gateway, a software solution used for enterprise security and integration requirements. The vulnerabilities affect versions prior to 11.0.0.0, 10.6.0.9, 10.6.6.0, and 10.5.0.21 running on Linux and UNIX operating systems. A remote attacker can exploit these flaws to conduct denial of service attacks and manipulate data. The CVSS Base Score is 6.5 (medium) and Temporal Score is 5.7 (medium).

Organizations using IBM DataPower Gateway should immediately identify whether they are running affected versions on their Linux or UNIX systems. If affected versions are in use, administrators should apply available patches to update to a secure version. Since mitigation measures are noted as available, organizations should review vendor recommendations and implement appropriate security controls to reduce exposure to remote attacks.