SB2017022710 - Multiple vulnerabilities in NetIQ Identity Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2016-1600)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the ServiceNow driver. A remote attacker can gain unauthorized access to sensitive information on the system.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2017-7434)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the JDBC driver of NetIQ Identity Manager send out an incorrect XML configuration, which can result in passwords being logged into exception logfiles.

Remediation

Install update from vendor's website.

References

• https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html#t433o7au0niu
• https://bugzilla.suse.com/show_bug.cgi?id=1005907
• https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html