Security Bulletin: Password Encryption / Decryption affects IBM Control Center (CVE-2016-0252)

Summary

IBM Control Center passwords could be compromised with reverse engineering and other conditions.

Vulnerability Details

CVEID: CVE-2016-0252**
DESCRIPTION:** IBM Control Center could allow a local attacker, under special conditions, to decrypt the master key which in turn could be used to decrypt application passwords.
CVSS Base Score: 5.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110561 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Control Center 5.4.0 through 5.4.2.1 iFix08
IBM Control Center 6.0.0.0 through 6.0.0.1 iFix05

Remediation/Fixes

IBM Control Center

| 6.0.0.1 iFix06| Fix Central - 6.0.0.1
—|—|—
Sterling Control Center| 5.4.2.1 iFix09| Fix Central - 5.4.2.1

Workarounds and Mitigations

None.