cnvd - cnvd-2016-06856

cnvd-2016-06856

Vulnerability from cnvd

Title: IBM Security Identity Manager Virtual Appliance信息泄露漏洞

Description:

IBM Security Identity Manager（ISIM）是美国IBM公司的一套身份管理和治理解决方案。该方案可在整个用户生命周期内自动创建、修改、重新认证和终止用户特权，并支持基于策略的密码管理。IBM Security Identity Manager（ISIM）Virtual Appliance是ISIM虚拟应用程序。

IBM Security Identity Manager Virtual Appliance存在安全漏洞，该漏洞会导致在错误消息中显示敏感信息，经过身份认证的用户可以利用该漏洞对系统进行进一步攻击。

Severity: 低

Patch Name: IBM Security Identity Manager Virtual Appliance信息泄露漏洞的补丁

Patch Description:

IBM Security Identity Manager Virtual Appliance存在安全漏洞，该漏洞会导致在错误消息中显示敏感信息，经过身份认证的用户可以利用该漏洞对系统进行进一步攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞 http://www-01.ibm.com/support/docview.wss?uid=swg21989198

Reference: https://www.auscert.org.au/render.html?it=37990 http://www-01.ibm.com/support/docview.wss?uid=swg21989198

Impacted products

Name
['IBM Security Identity Manager Virtual Appliance 7.0.0.0', 'IBM Security Identity Manager Virtual Appliance 7.0.0.1', 'IBM Security Identity Manager Virtual Appliance 7.0.0.2', 'IBM Security Identity Manager Virtual Appliance 7.0.0.3', 'IBM Security Identity Manager Virtual Appliance 7.0.1.0', 'IBM Security Identity Manager Virtual Appliance 7.0.1.1', 'IBM Security Identity Manager Virtual Appliance 7.0.1.3']

Name

['IBM Security Identity Manager Virtual Appliance 7.0.0.0', 'IBM Security Identity Manager Virtual Appliance 7.0.0.1', 'IBM Security Identity Manager Virtual Appliance 7.0.0.2', 'IBM Security Identity Manager Virtual Appliance 7.0.0.3', 'IBM Security Identity Manager Virtual Appliance 7.0.1.0', 'IBM Security Identity Manager Virtual Appliance 7.0.1.1', 'IBM Security Identity Manager Virtual Appliance 7.0.1.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-0351"
    }
  },
  "description": "IBM Security Identity Manager\uff08ISIM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u7ba1\u7406\u548c\u6cbb\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u5728\u6574\u4e2a\u7528\u6237\u751f\u547d\u5468\u671f\u5185\u81ea\u52a8\u521b\u5efa\u3001\u4fee\u6539\u3001\u91cd\u65b0\u8ba4\u8bc1\u548c\u7ec8\u6b62\u7528\u6237\u7279\u6743\uff0c\u5e76\u652f\u6301\u57fa\u4e8e\u7b56\u7565\u7684\u5bc6\u7801\u7ba1\u7406\u3002IBM Security Identity Manager\uff08ISIM\uff09Virtual Appliance\u662fISIM\u865a\u62df\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nIBM Security Identity Manager Virtual Appliance\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4f1a\u5bfc\u81f4\u5728\u9519\u8bef\u6d88\u606f\u4e2d\u663e\u793a\u654f\u611f\u4fe1\u606f\uff0c\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u7528\u6237\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u7cfb\u7edf\u8fdb\u884c\u8fdb\u4e00\u6b65\u653b\u51fb\u3002",
  "discovererName": "IBM",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u53d6\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21989198",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-06856",
  "openTime": "2016-08-29",
  "patchDescription": "IBM Security Identity Manager\uff08ISIM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u7ba1\u7406\u548c\u6cbb\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u5728\u6574\u4e2a\u7528\u6237\u751f\u547d\u5468\u671f\u5185\u81ea\u52a8\u521b\u5efa\u3001\u4fee\u6539\u3001\u91cd\u65b0\u8ba4\u8bc1\u548c\u7ec8\u6b62\u7528\u6237\u7279\u6743\uff0c\u5e76\u652f\u6301\u57fa\u4e8e\u7b56\u7565\u7684\u5bc6\u7801\u7ba1\u7406\u3002IBM Security Identity Manager\uff08ISIM\uff09Virtual Appliance\u662fISIM\u865a\u62df\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nIBM Security Identity Manager Virtual Appliance\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4f1a\u5bfc\u81f4\u5728\u9519\u8bef\u6d88\u606f\u4e2d\u663e\u793a\u654f\u611f\u4fe1\u606f\uff0c\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u7528\u6237\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u7cfb\u7edf\u8fdb\u884c\u8fdb\u4e00\u6b65\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Identity Manager Virtual Appliance\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Security Identity Manager Virtual Appliance 7.0.0.0",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.1",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.2",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.3",
      "IBM Security Identity Manager Virtual Appliance 7.0.1.0",
      "IBM Security Identity Manager Virtual Appliance 7.0.1.1",
      "IBM Security Identity Manager Virtual Appliance 7.0.1.3"
    ]
  },
  "referenceLink": "https://www.auscert.org.au/render.html?it=37990\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21989198",
  "serverity": "\u4f4e",
  "submitTime": "2016-08-25",
  "title": "IBM Security Identity Manager Virtual Appliance\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2016-0351 (GCVE-0-2016-0351)

Vulnerability from cvelistv5

Published

2018-02-21 16:00

Modified

2024-08-05 22:15

Severity ?

CWE

Summary

IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890.

References

▼	URL	Tags
	http://www-01.ibm.com/support/docview.wss?uid=swg21989198	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/111890	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:15:24.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989198"
          },
          {
            "name": "ibm-sim-cve20160351-info-disc(111890)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111890"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-21T15:57:02",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989198"
        },
        {
          "name": "ibm-sim-cve20160351-info-disc(111890)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111890"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-0351",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21989198",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989198"
            },
            {
              "name": "ibm-sim-cve20160351-info-disc(111890)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111890"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-0351",
    "datePublished": "2018-02-21T16:00:00",
    "dateReserved": "2015-12-08T00:00:00",
    "dateUpdated": "2024-08-05T22:15:24.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted