PT-2016-4148 · Ibm · Ibm Rational Software Architect Design Manager+6

Publicado 2016-11-24 · Atualizado 2016-11-28 · CVE-2016-0325

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Rational Collaborative Lifecycle Management versions 3.0.1.6 through 6.0 before 6.0.2 iFix5 Rational Quality Manager versions 3.0.1.6 through 6.0 before 6.0.2 iFix5 Rational Team Concert versions 3.0.1.6 through 6.0 before 6.0.2 iFix5 Rational DOORS Next Generation versions 4.0 through 6.0 before 6.0.2 iFix5 Rational Engineering Lifecycle Manager versions 4.0 through 6.0 before 6.0.2 iFix5 Rational Rhapsody Design Manager versions 4.0 through 6.0 before 6.0.2 iFix5 Rational Software Architect Design Manager versions 4.0 through 6.0 before 6.0.2 iFix5

Description The issue allows remote authenticated users to execute arbitrary OS commands via a crafted request.

Recommendations For IBM Rational Collaborative Lifecycle Management versions 3.0.1.6 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational Quality Manager versions 3.0.1.6 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational Team Concert versions 3.0.1.6 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational DOORS Next Generation versions 4.0 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational Engineering Lifecycle Manager versions 4.0 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational Rhapsody Design Manager versions 4.0 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version. For Rational Software Architect Design Manager versions 4.0 through 6.0 before 6.0.2 iFix5, apply the respective iFix to the version.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2016-0325

Produtos afetados

Ibm Rational Collaborative Lifecycle Management

Ibm Rational Doors Next Generation

Ibm Rational Engineering Lifecycle Manager

Ibm Rational Quality Manager

Rational Rhapsody Design Manager

Ibm Rational Software Architect Design Manager

Ibm Rational Team Concert

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-0325 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21991478 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0325 · Nota de Segurança
• http://securityfocus.com/bid/94539 · Nota