CVE-2014-0838: High severity IBM QRadar Security Information and Event Manager vulnerability
The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Security QRadar SIEM AutoUpdateto a version that resolves this vulnerability.Fixed in 6.4 - Compensating control
Because remote attackers can execute arbitrary console commands by leveraging control of the server, restrict network access to the system/console from untrusted sources (e.g., at the firewall/ACL) until AutoUpdate is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0838?
CVE-2014-0838 is rated as a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2014-0838?
To fix CVE-2014-0838, you should upgrade to IBM Security QRadar SIEM version 6.4 or later.
What systems are affected by CVE-2014-0838?
CVE-2014-0838 affects IBM Security QRadar SIEM versions up to 7.2 MR1 and earlier.
Can CVE-2014-0838 be exploited remotely?
Yes, CVE-2014-0838 can be exploited remotely by attackers with control over the server.
What are the consequences of CVE-2014-0838 exploitation?
Exploitation of CVE-2014-0838 can lead to arbitrary command execution on the vulnerable system.