Security Bulletin: IBM Security Key Lifecycle Manager is affected by inadequate account lockout setting (CVE-2016-6095)

Summary IBM Security Key Lifecycle Manager allows attacker to conduct brute force dictionary attacks to bypass authentication because it is missing an account lockout mechanism. Vulnerability Details CVEID: CVE-2016-6095 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses an inadequate account...

CVE-2016-6095

CVE-2016-6095 affects IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager) v2.5 (2.5.0.7) and v2.6 (2.6.0.2). Root cause: inadequate account lockout settings that could enable remote brute-force credential attempts. Impact stated: could allow an attacker to guess accounts; C...