Lucene search

[email protected]CVE-2016-0380

HistoryAug 08, 2016 - 1:59 a.m.

CVE-2016-0380

2016-08-0801:59:05

CWE-264

[email protected]

web.nvd.nist.gov

cve-2016-0380

ibm

sterling

connect:direct

unix

file permissions

information security

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.6 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.

Affected configurations

NVD

Node

ibmsterling_connect\Matchdirect4.1.0.0unix

ibmsterling_connect\Matchdirect4.1.0.1unix

ibmsterling_connect\Matchdirect4.1.0.2unix

ibmsterling_connect\Matchdirect4.1.0.3unix

ibmsterling_connect\Matchdirect4.1.0.4unix

ibmsterling_connect\Matchdirect4.2.0.0unix

ibmsterling_connect\Matchdirect4.2.0.1unix

ibmsterling_connect\Matchdirect4.2.0.2unix

ibmsterling_connect\Matchdirect4.2.0.3unix

ibmsterling_connect\Matchdirect4.2.0.4unix

CPENameOperatorVersion
ibm:sterling_connect\:directibm sterling connect:directeq4.1.0.0
ibm:sterling_connect\:directibm sterling connect:directeq4.1.0.1
ibm:sterling_connect\:directibm sterling connect:directeq4.1.0.2
ibm:sterling_connect\:directibm sterling connect:directeq4.1.0.3
ibm:sterling_connect\:directibm sterling connect:directeq4.1.0.4
ibm:sterling_connect\:directibm sterling connect:directeq4.2.0.0
ibm:sterling_connect\:directibm sterling connect:directeq4.2.0.1
ibm:sterling_connect\:directibm sterling connect:directeq4.2.0.2
ibm:sterling_connect\:directibm sterling connect:directeq4.2.0.3
ibm:sterling_connect\:directibm sterling connect:directeq4.2.0.4

CPE	Name	Operator	Version
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.1.0.0
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.1.0.1
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.1.0.2
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.1.0.3
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.1.0.4
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.2.0.0
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.2.0.1
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.2.0.2
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.2.0.3
ibm:sterling_connect\:direct	ibm sterling connect:direct	eq	4.2.0.4

References

www-01.ibm.com/support/docview.wss?uid=swg1IT14769

www-01.ibm.com/support/docview.wss?uid=swg21988278

www.securityfocus.com/bid/92336

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.6 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2016-0380

prion1 ibm1 cvelist1 nvd1