CVE-2016-0351: Infoleak

Published Feb 21, 2018

Updated

IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890.

Affected Software

7 affected components

IBM Security Identity Manager Virtual Appliance=7.0.0.0

IBM Security Identity Manager Virtual Appliance=7.0.0.1

IBM Security Identity Manager Virtual Appliance=7.0.0.2

IBM Security Identity Manager Virtual Appliance=7.0.0.3

IBM Security Identity Manager Virtual Appliance=7.0.1.0

IBM Security Identity Manager Virtual Appliance=7.0.1.1

IBM Security Identity Manager Virtual Appliance=7.0.1.3

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21989198

Event History

Feb 21, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity level of CVE-2016-0351?

The severity level of CVE-2016-0351 is medium.

How does CVE-2016-0351 affect IBM Security Identity Manager Virtual Appliance?

CVE-2016-0351 affects IBM Security Identity Manager Virtual Appliance versions 7.0.x before 7.0.1.3-ISS-SIM-IF0001.

What is the vulnerability description of CVE-2016-0351?

CVE-2016-0351 is a vulnerability in IBM Security Identity Manager Virtual Appliance that allows remote attackers to capture the session cookie in an HTTPS session.

How can I fix CVE-2016-0351?

To fix CVE-2016-0351, update to IBM Security Identity Manager Virtual Appliance version 7.0.1.3-ISS-SIM-IF0001 or later.

Are there any references for CVE-2016-0351?

For more information on CVE-2016-0351, you can refer to the following links: [IBM Security Bulletin](http://www-01.ibm.com/support/docview.wss?uid=swg21989198) and [IBM X-Force ID](https://exchange.xforce.ibmcloud.com/vulnerabilities/111890).