CVE-2016-2880: High severity IBM QRadar Security Information and Event Manager vulnerability

Published Mar 1, 2017

Updated

IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. IBM Reference #: 1997340.

Affected Software

8 affected components

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

IBM QRadar Security Information and Event Manager=7.2.5

IBM QRadar Security Information and Event Manager=7.2.6

IBM QRadar Security Information and Event Manager=7.2.7

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21997340

Event History

Mar 1, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Data Sourced

via NVD·09:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability associated with CVE-2016-2880?

CVE-2016-2880 describes a security flaw in IBM QRadar 7.2 that allows a local user to access the stored encryption key for the service account password.

What are the affected versions of IBM QRadar for CVE-2016-2880?

The affected versions of IBM QRadar for CVE-2016-2880 include 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, and 7.2.7.

What is the severity level of CVE-2016-2880?

CVE-2016-2880 is classified as a medium severity vulnerability.

How can I mitigate the risk of CVE-2016-2880?

To mitigate the risk of CVE-2016-2880, it is recommended to update IBM QRadar to the latest version to ensure the encryption of sensitive information is secure.

Who can exploit CVE-2016-2880?

CVE-2016-2880 can be exploited by any local user who has access to the system on which the affected IBM QRadar versions are installed.