CVE-2023-33838
📋 TL;DR
IBM Security Verify Governance 10.0.2 Identity Manager stores passwords using unsalted cryptographic hashes, making them vulnerable to rainbow table attacks. This affects organizations using this specific version of IBM's identity management software. Attackers could potentially recover passwords from stolen hash databases.
💻 Affected Systems
- IBM Security Verify Governance Identity Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain password database and use precomputed rainbow tables to recover administrative credentials, leading to complete identity management system compromise and privilege escalation across integrated systems.
Likely Case
If password hashes are exposed through other vulnerabilities or data breaches, attackers could recover some user passwords, particularly weak ones, leading to account compromise.
If Mitigated
With proper network segmentation and access controls limiting database exposure, the risk is reduced to internal threats with database access.
🎯 Exploit Status
Exploitation requires access to password hashes, typically through database compromise or other vulnerabilities. Once hashes are obtained, standard rainbow table attacks apply.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply interim fix or upgrade as per IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/7172200
Restart Required: Yes
Instructions:
1. Review IBM advisory at provided URL
2. Apply interim fix or upgrade to patched version
3. Restart affected services
4. Force password resets for all users to generate new salted hashes
🔧 Temporary Workarounds
Enforce strong password policies
allRequire complex, long passwords to make rainbow table attacks less effective
Implement additional authentication layers
allAdd multi-factor authentication to reduce impact of password compromise
🧯 If You Can't Patch
- Isolate the Identity Manager database with strict access controls and network segmentation
- Implement comprehensive monitoring and alerting for database access attempts
🔍 How to Verify
Check if Vulnerable:
Check IBM Security Verify Governance version; if running 10.0.2, it is vulnerableCheck Version:
Check product documentation for version verification specific to IBM Security Verify GovernanceVerify Fix Applied:
Verify version is updated and check that new password hashes include salt values in storage📡 Detection & Monitoring
Log Indicators:
- Unusual database access patterns
- Failed authentication attempts followed by successful logins
Network Indicators:
- Unexpected connections to database ports from unauthorized sources
SIEM Query:
source="*database*" AND (event_type="access" OR event_type="query") AND user NOT IN [authorized_users]