SB2017022710 - Multiple vulnerabilities in NetIQ Identity Manager

Description

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2016-1600)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the ServiceNow driver. A remote attacker can gain unauthorized access to sensitive information on the system.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2017-7434)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the JDBC driver of NetIQ Identity Manager send out an incorrect XML configuration, which can result in passwords being logged into exception logfiles.

Remediation

Install update from vendor's website.

References

• https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html#t433o7au0niu
• https://bugzilla.suse.com/show_bug.cgi?id=1005907
• https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html