PT-2018-4125 · Ibm · Ibm Security Key Lifecycle Manager

Published 2018-04-25 · Updated 2018-06-13 · CVE-2014-0872

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Low

Base vector

AV:L/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Key Lifecycle Manager version 2.5

Description The installation process stores unencrypted credentials, potentially allowing local users with root access to obtain sensitive information.

Recommendations For IBM Security Key Lifecycle Manager version 2.5, consider restricting root access to minimize the risk of exploitation until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-255

CWE-200

Related Identifiers

CVE-2014-0872

Affected Products

Ibm Security Key Lifecycle Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-0872 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90988 · Vendor Advisory
• https://ibm.com/blogs/psirt/ibm-security-bulletin-unencrypted-credentials-stored-on-ibm-security-key-lifecycle-manager-server-cve-2014-0872 · Vendor Advisory