Vulnerability-Lookup

CNVD-2017-01222

Vulnerability from cnvd - Published: 2017-02-09

Title

IBM Jazz for Service Management信息泄露漏洞

Description

IBM Jazz for Service Management在整合服务管理和一些关键领域的第三方产品如报告、安全和行政服务等提供了增强的解决方案。 IBM Jazz for Service Management存在信息泄露漏洞，攻击者可利用漏洞获得敏感信息。

Severity

高

Patch Name

IBM Jazz for Service Management信息泄露漏洞的补丁

Patch Description

IBM Jazz for Service Management在整合服务管理和一些关键领域的第三方产品如报告、安全和行政服务等提供了增强的解决方案。 IBM Jazz for Service Management存在信息泄露漏洞，攻击者可利用漏洞获得敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可联系供应商获得补丁信息： http://www-01.ibm.com/support/docview.wss?uid=swg21997711

Reference

http://www-01.ibm.com/support/docview.wss?uid=swg21997711

Impacted products

Name
['IBM Jazz for Service Management 1.1.3', 'IBM Dashboard Application Services Hub 3.1.3']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96003"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5935"
    }
  },
  "description": "IBM Jazz for Service Management\u5728\u6574\u5408\u670d\u52a1\u7ba1\u7406\u548c\u4e00\u4e9b\u5173\u952e\u9886\u57df\u7684\u7b2c\u4e09\u65b9\u4ea7\u54c1\u5982\u62a5\u544a\u3001\u5b89\u5168\u548c\u884c\u653f\u670d\u52a1\u7b49\u63d0\u4f9b\u4e86\u589e\u5f3a\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nIBM Jazz for Service Management\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "IBM",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21997711",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01222",
  "openTime": "2017-02-09",
  "patchDescription": "IBM Jazz for Service Management\u5728\u6574\u5408\u670d\u52a1\u7ba1\u7406\u548c\u4e00\u4e9b\u5173\u952e\u9886\u57df\u7684\u7b2c\u4e09\u65b9\u4ea7\u54c1\u5982\u62a5\u544a\u3001\u5b89\u5168\u548c\u884c\u653f\u670d\u52a1\u7b49\u63d0\u4f9b\u4e86\u589e\u5f3a\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nIBM Jazz for Service Management\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Jazz for Service Management\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Jazz for Service Management 1.1.3",
      "IBM Dashboard Application Services Hub 3.1.3"
    ]
  },
  "referenceLink": "http://www-01.ibm.com/support/docview.wss?uid=swg21997711",
  "serverity": "\u9ad8",
  "submitTime": "2017-02-06",
  "title": "IBM Jazz for Service Management\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2016-5935 (GCVE-0-2016-5935)

Vulnerability from cvelistv5 – Published: 2017-02-02 22:00 – Updated: 2024-08-06 01:15

Summary

IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

Severity ?

No CVSS data available.

CWE

Obtain Information

Assigner

ibm

References

2 references

URL	Tags
http://www.securityfocus.com/bid/96003	vdb-entryx_refsource_BID
http://www.ibm.com/support/docview.wss?uid=swg21997711	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
IBM Corporation	Tivoli Components	Affected: 1.1 Affected: 1.1.0.1 Affected: 1.1.0.2 Affected: 1.1.0.3 Affected: 2.1 Affected: 2.2 Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.2.1 Affected: 2.1.1.0 Affected: 2.1.1.2 Affected: 1.1.3

Date Public ?

2017-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:15:10.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96003",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96003"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg21997711"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tivoli Components",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "1.1.0.1"
            },
            {
              "status": "affected",
              "version": "1.1.0.2"
            },
            {
              "status": "affected",
              "version": "1.1.0.3"
            },
            {
              "status": "affected",
              "version": "2.1"
            },
            {
              "status": "affected",
              "version": "2.2"
            },
            {
              "status": "affected",
              "version": "1.1.1"
            },
            {
              "status": "affected",
              "version": "1.1.2"
            },
            {
              "status": "affected",
              "version": "1.1.2.1"
            },
            {
              "status": "affected",
              "version": "2.1.1.0"
            },
            {
              "status": "affected",
              "version": "2.1.1.2"
            },
            {
              "status": "affected",
              "version": "1.1.3"
            }
          ]
        }
      ],
      "datePublic": "2017-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-06T10:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "96003",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96003"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg21997711"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-5935",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tivoli Components",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.1"
                          },
                          {
                            "version_value": "1.1.0.1"
                          },
                          {
                            "version_value": "1.1.0.2"
                          },
                          {
                            "version_value": "1.1.0.3"
                          },
                          {
                            "version_value": "2.1"
                          },
                          {
                            "version_value": "2.2"
                          },
                          {
                            "version_value": "1.1.1"
                          },
                          {
                            "version_value": "1.1.2"
                          },
                          {
                            "version_value": "1.1.2.1"
                          },
                          {
                            "version_value": "2.1.1.0"
                          },
                          {
                            "version_value": "2.1.1.2"
                          },
                          {
                            "version_value": "1.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96003",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96003"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg21997711",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg21997711"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-5935",
    "datePublished": "2017-02-02T22:00:00.000Z",
    "dateReserved": "2016-06-29T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:15:10.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-01222

CVE-2016-5935 (GCVE-0-2016-5935)

Tags

Sightings

Nomenclature