Security Bulletin: Apache Solr as used in IBM QRadar SIEM and Incident Forensics is vulnerable to a denial of service (CVE-2014-0050)

Summary Apache Solr is vulnerable to a denial of service attack. Vulnerability Details CVEID: CVE-2014-0050 DESCRIPTION: Apache Commons FileUpload, as used in Apache Tomcat, Solr, and other products is vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header...

Security Bulletin: IBM QRadar SIEM uses broken or risky cryptographic algorithms (CVE-2016-2879)

Summary The software uses an outdated insecure cipher or it is using a proprietary crypto standard which is likely to be vulnerable. Outdated/broken algorithms are MD4, MD5, SHA1, DES, ECB, RC4, Export ciphers, SSLv2, SSLv3, DH using keys less than 1024 Vulnerability Details CVEID: CVE-2016-2879...

Security Bulletin: IBM QRadar SIEM contains hard-coded credentials (CVE-2016-2880)

Summary An IBM QRadar SIEM user with shell access could obtain the encryption key used to encrypt certain passwords. Vulnerability Details CVEID: CVE-2016-2880 DESCRIPTION: IBM QRadar stores the encryption key used to encrypt the service account password which can be obtained by a local user. CVS...

Security Bulletin: Apache POI as used in IBM QRadar SIEM is vulnerable to various CVEs.

Summary Vulnerabilities affecting Apache Poi as used in IBM QRadar SIEM Vulnerability Details CVE-ID: CVE-2012-0213 Description: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compound File Binary...

Security Bulletin: IBM QRadar SIEM is vulnerable to various CGI vulnerabilities. (CVE-2016-5385, CVE-2016-5387, CVE-2016-5388)

Summary Vulnerabilities affecting web servers that run code in a CGI or CGI-like context Vulnerability Details CVEID: CVE-2016-5387 DESCRIPTION: Apache HTTP Server could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the...

Security Bulletin: IBM QRadar SIEM is vulnerable to OS command injection. (CVE-2016-2875)

Summary It is possible to inject a payload with OS Commands in QRadar which are run as root on the host OS. Vulnerability Details CVE-ID: CVE-2016-2875 Description: IBM QRadar could allow an authenticated user to inject operating system commands that would be executed with root privileges. CVSS...

Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to multiple CVE's.

Summary OpenSSL vulnerabilities disclosed on May 3 2016, https://www.openssl.org/news/secadv/20160503.txt plus CVE-2016-2842. Vulnerability Details CVE-ID: CVE-2016-2105 Description: OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the EVPEncodeUpdate...

Security Bulletin: IBM QRadar SIEM and Incident Forensics relies on an untrusted input. (CVE-2016-2881)

Summary The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. Vulnerability Details CVE-ID: CVE-2016-2881 Description: IBM QRadar and Incident Forensics...

Security Bulletin: IBM Java as used in IBM QRadar SIEM is vulnerable to information disclosure. (CVE-2016-3426)

Summary All applicable CVEs from Oracle's January 2016 CPU, plus CVE-2016-0636 and three additional IBM-specific vulnerabilities CVE-2016-0363, CVE-2016-0376, and CVE-2016-0264. Vulnerability Details CVEID: CVE-2016-3426 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect authorization. (CVE-2016-2874)

Summary The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Vulnerability Details CVE-ID: CVE-2016-2874 Description: IBM QRadar under some configurations allow product authorization rules to be bypassed...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting. (CVE-2016-2869)

Summary Cross-Site Scripting was found in various fields in the QRadar UI. Vulnerability Details CVE-ID: CVE-2016-2869 Description: IBM QRadar is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a...

Security Bulletin: IBM QRadar SIEM is vulnerable to clear text passwords. (CVE-2016-2871)

Summary Some passwords in IBM QRadar SIEM were found in configuration files in clear text. Vulnerability Details CVE-ID: CVE-2016-2871 Description: IBM QRadar stores passwords in clear text in configuration files, that could allow a local user to obtain critical sensitive information and gain...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-2877)

Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-2877 Description: IBM QRadar could allow a local user to write files to certain web accessible...

Security Bulletin: IBM QRadar SIEM is vulnerable to SQL Injection. (CVE-2016-2873)

Summary IBM QRadar SIEM was found to be vulnerable to SQL injection. Vulnerability Details CVE-ID: CVE-2016-2873 Description: IBM QRadar is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete...

Security Bulletin: Samba as used in IBM QRadar SIEM is vulnerable to multiple CVE's. (CVE-2016-2110, CVE-2016-2112, CVE-2016-2115)

Summary Samba is susceptible to multiple vulnerabilities as used in IBM QRadar SIEM. Vulnerability Details CVE-ID: CVE-2016-2110 Description: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the feature negotiation of NTLMSSP from a downgrade. ...

Security Bulletin: IBM QRadar SIEM is vulnerable to untrusted XML External Entity uploads. (CVE-2016-2868)

Summary XML External Entity injection in the UI of QRadar allows someone with privileges to upload unvalidated XML. Vulnerability Details CVE-ID: CVE-2016-2868 Description: IBM QRadar could allow a remote attacker with administrator privileges to obtain sensitive information, caused by an error...

Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is susceptible to multiple vulnerabilities. (CVE-2015-5345, CVE-2016-0706, CVE-2016-0714, CVE-2015-5174)

Summary Open Source Apache Tomcat is susceptible to multiple vulnerabilities. Vulnerability Details CVE-ID: CVE-2015-5345 Description: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, a...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM QRadar SIEM and QRadar Incident Forensics.

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM QRadar SIEM and Incident Forensics. IBM QRadar SIEM and Incident Forensics has addressed the applicable CVEs including the “DROWN: Decrypting RSA with Obsolete and Weakened encryption"...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM QRadar SIEM and Incident Forensics (CVE-2015-7547)

Summary A GNU C library glibc stack-based buffer overflow in getaddrinfo vulnerability affects IBM QRadar SIEM and Incident Forensics. Vulnerability Details CVEID: CVE-2015-7547 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM QRadar SIEM and Incident Forensics. (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM QRadar SIEM and Incident Forensics. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID:...