SB2018080625 - Multiple vulnerabilities in IBM Security Identity Governance and Intelligence (IGI)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018080625

SB2018080625 - Multiple vulnerabilities in IBM Security Identity Governance and Intelligence (IGI)

Published: August 6, 2018 Updated: August 8, 2020

Security Bulletin ID SB2018080625
Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 14% Medium 57% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Inadequate Encryption Strength (CVE-ID: CVE-2017-1366)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859.


2) Session Fixation (CVE-ID: CVE-2017-1368)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.


3) Input validation error (CVE-ID: CVE-2017-1396)

The vulnerability allows a remote authenticated user to read and manipulate data.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342.


4) Information disclosure (CVE-ID: CVE-2017-1409)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396.


5) Insufficiently protected credentials (CVE-ID: CVE-2017-1411)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399.


6) Information disclosure (CVE-ID: CVE-2017-1412)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400.


7) Input validation error (CVE-ID: CVE-2017-1755)

The vulnerability allows a local privileged user to execute arbitrary code.

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files that could be executed by the administrator. IBM X-Force ID: 135855.


Remediation

Install update from vendor's website.

References