CVE-2015-2016: Critical severity ibm qradar security information and event manager vulnerability

Published Oct 4, 2015

Updated

Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.

Affected Software

6 affected components

IBM QRadar Security Information and Event Manager=7.1.0

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21965813

Event History

Oct 4, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2016?

CVE-2015-2016 is considered a high severity vulnerability due to the potential for remote code execution with root privileges.

How do I fix CVE-2015-2016?

To fix CVE-2015-2016, upgrade IBM QRadar SIEM to version 7.1 MR2 Patch 11 IF02 or version 7.2.x to 7.2.5 Patch 4 or later.

Who is affected by CVE-2015-2016?

CVE-2015-2016 affects authenticated remote users of IBM QRadar SIEM versions 7.1 MR2 before Patch 11 IF02 and 7.2.0 through 7.2.4.

What type of attacks can CVE-2015-2016 enable?

CVE-2015-2016 can enable remote authenticated users to execute arbitrary commands on the affected system.

Is there a workaround for CVE-2015-2016?

There is no documented workaround for CVE-2015-2016; applying the patch is the recommended solution.