CVE-2021-38979
📋 TL;DR
IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 store passwords using unsalted cryptographic hashes, making them vulnerable to rainbow table and brute-force attacks. This affects organizations using these versions for cryptographic key management. Attackers could potentially recover passwords from stored hash values.
💻 Affected Systems
- IBM Tivoli Key Lifecycle Manager
📦 What is this software?
Security Guardium Key Lifecycle Manager by Ibm
View all CVEs affecting Security Guardium Key Lifecycle Manager →
Security Guardium Key Lifecycle Manager by Ibm
View all CVEs affecting Security Guardium Key Lifecycle Manager →
⚠️ Risk & Real-World Impact
Worst Case
Attackers recover administrative passwords, gain full control of the key management system, and compromise all managed cryptographic keys, leading to data decryption and system compromise.
Likely Case
Attackers with access to password hashes recover weaker passwords, gaining unauthorized access to the key management interface and potentially extracting some cryptographic keys.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific Tivoli Key Lifecycle Manager instance, though password recovery remains possible.
🎯 Exploit Status
Exploitation requires access to password hash storage, which typically requires some level of system access. Password cracking tools can be used against obtained hashes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply interim fix or upgrade to version 4.1.0.2 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/6516034
Restart Required: Yes
Instructions:
1. Download the interim fix from IBM Fix Central. 2. Stop all Tivoli Key Lifecycle Manager services. 3. Apply the fix according to IBM instructions. 4. Restart all services. 5. Force password resets for all accounts.
🔧 Temporary Workarounds
Enforce strong password policies
allRequire complex, long passwords to make hash cracking more difficult
Restrict access to hash storage
allImplement strict file permissions and access controls on password hash files
🧯 If You Can't Patch
- Implement network segmentation to isolate Tivoli Key Lifecycle Manager from untrusted networks
- Enable multi-factor authentication if supported and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check installed version via administrative console or version command. Versions 3.0, 3.0.1, 4.0, and 4.1 are vulnerable.Check Version:
Check product documentation for version command specific to your installation methodVerify Fix Applied:
Verify version is 4.1.0.2 or later, or confirm interim fix is applied via patch management system.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Unusual access patterns to password files
- Administrative password changes
Network Indicators:
- Unusual connections to Tivoli Key Lifecycle Manager ports
- Traffic patterns suggesting hash extraction
SIEM Query:
source="tivoli_klm" AND (event_type="authentication_failure" OR file_access="*password*")