8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
IBM QRadar Network Security is affected by Linux kernel vulnerabilities
CVEID:CVE-2019-7221
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in the way KVM hypervisor emulates a preemption timer for L2 guests when nested (=1) virtualization is enabled… A local authenticated attacker could exploit this vulnerability to crash the host kernel and possibly gain privileged access to a system.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/157079> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
CVEID:CVE-2019-6974
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the improper handling of reference counting by kvm_ioctl_create_device in virt/kvm/kvm_main.c. A local authenticated attacker could exploit this vulnerability to trigger a use-after-free to crash the guest VM and possibly gain privileged access to a system.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/157074> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVEID:CVE-2018-17972
DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by a flaw in the proc_pid_stack function in fs/proc/base.c. By sending a specially-crafted request, a local attacker could exploit this vulnerability to obtain kernel task stack contents.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/150826> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID:CVE-2018-9568
DESCRIPTION: Google Android could allow a local attacker to gain elevated privileges on the system, caused by a type confusion flaw in the sk_clone_lock function in sock.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/153889> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
IBM QRadar Network Security 5.4.0
IBM QRadar Network Security 5.5.0
Product | VRMF | Remediation/First Fix |
---|---|---|
IBM QRadar Network Security | 5.4.0 | Install Firmware 5.4.0.8 from the Available Updates page of the Local Management Interface, or by performing a One Time Scheduled Installation from SiteProtector. |
Or | ||
Download Firmware 5.4.0.8 from IBM Security License Key and Download Center and upload and install via the Available Updates page of the Local Management Interface. | ||
IBM QRadar Network Security | 5.5.0 | Install Firmware 5.5.0.3 from the Available Updates page of the Local Management Interface, or by performing a One Time Scheduled Installation from SiteProtector. |
Or | ||
Download Firmware 5.5.0.3 from IBM Security License Key and Download Center and upload and install via the Available Updates page of the Local Management Interface. |
CPE | Name | Operator | Version |
---|---|---|---|
ibm qradar network security | eq | 5.4.0 | |
ibm qradar network security | eq | 5.5.0 |
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C