Security Bulletin: IBM QRadar Wincollect is vulnerable to improper access control (CVE-2020-4485, CVE-2020-4486)

Summary

IBM QRadar Wincollect agents could allow authenticated users to bypass restrictions to delete arbitrary files or disable the Wincollect service.

Vulnerability Details

CVEID:CVE-2020-4485
**DESCRIPTION:**IBM QRadar could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing security mechanisms in future attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181860 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-4486
**DESCRIPTION:**IBM QRadar could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181861 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

Update:

There is a new update for the Wincollect agent that does not require uninstalling and reinstalling. The following Wincollect agent versions can be used to upgrade the affected versions to resolve the vulnerability. For information on how to update your WinCollect version, see the WinCollect 7.3.0 Patch 1 release notes: <https://www.ibm.com/support/pages/node/6347638&gt;.

Download and install the WinCollect 7.3.0-41 based on your QRadar version:

• For QRadar 7.4.x: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&produc[…]AGENT-wincollect-7.3.0-41.x64.exe&includeSupersedes=0&source=fc
• For QRadar 7.3.x: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&produc[…]AGENT-wincollect-7.3.0-41.x64.exe&includeSupersedes=0&source=fc

Workarounds and Mitigations

None