PT-2018-4619 · Ibm · Ibm Security Identity Manager Virtual Appliance

Chris Shepherd + 6 · Published 2018-02-21 · Updated 2018-03-13 · CVE-2016-0351

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager Virtual Appliance versions 7.0.x before 7.0.1.3-ISS-SIM-IF0001

Description The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the secure flag for the session cookie in an HTTPS session is not set.

Recommendations For IBM Security Identity Manager Virtual Appliance versions 7.0.x before 7.0.1.3-ISS-SIM-IF0001, update to version 7.0.1.3-ISS-SIM-IF0001 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTPS sessions to minimize the risk of cookie interception.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-0351

Affected Products

Ibm Security Identity Manager Virtual Appliance

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/111890 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21989198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0351 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0351 · Vendor Advisory