Security Bulletin: IBM License Metric Tool v9 and IBM Endpoint Manager for Software Use Analysis v2.2 and v9 are vulnerable to Padding Oracle On Downgraded Legacy Encryption (POODLE) attack on SSLv3 connections (CVE-2014-3566)

Summary SSLv3 protocol used to secure a number of connection paths in IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis is vulnerable to POODLE attack. This attack enables a man-in-the-middle attacker to decrypt and intercept communications, including user-server and...

PT-2015-6725

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions prior to 9.2.1.0 IBM Endpoint Manager for Software Use Analysis versions prior to 9.2.1.0 Description The issue allows remote authenticated users to bypass intended access restrictions and obtain sensitive...

CVE-2015-4929: Exposure of Sensitive Information to an Unauthorized Actor

IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request...

CVE-2014-8926

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-4774: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element...

PT-2015-3776

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 9.0.0 through 9.1.0.1 IBM Endpoint Manager for Software Use Analysis versions 9.0.0 through 9.1.0.1 Description The issue allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME...

PT-2015-3774

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions prior to 9.1.0.2 IBM Endpoint Manager for Software Use Analysis versions prior to 9.1.0.2 Description A cross-site request forgery CSRF issue exists in the login page, allowing remote attackers to hijack the...

CVE-2014-4778: Improper Input Validation

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element...