CVE-2016-6023: Path Traversal

Published Oct 6, 2016

Updated

Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.

Affected Software

9 affected components

IBM Sterling Secure Proxy=3.4.2.0

IBM Sterling Secure Proxy=3.4.2.0-ifix1

IBM Sterling Secure Proxy=3.4.2.0-ifix2

IBM Sterling Secure Proxy=3.4.2.0-ifix3

IBM Sterling Secure Proxy=3.4.2.0-ifix4

IBM Sterling Secure Proxy=3.4.2.0-ifix5

IBM Sterling Secure Proxy=3.4.2.0-ifix6

IBM Sterling Secure Proxy=3.4.2.0-ifix7

IBM Sterling Secure Proxy=3.4.3.0

Event History

Oct 6, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6023?

CVE-2016-6023 is considered a high severity vulnerability due to its potential to allow remote attackers to read arbitrary files.

How do I fix CVE-2016-6023?

To fix CVE-2016-6023, upgrade IBM Sterling Secure Proxy to version 3.4.2.0 iFix 8 or 3.4.3.0 iFix 1 or later.

What versions of IBM Sterling Secure Proxy are affected by CVE-2016-6023?

CVE-2016-6023 affects IBM Sterling Secure Proxy versions 3.4.2.0 and 3.4.3.0 before their respective iFix updates.

What kind of attack does CVE-2016-6023 enable?

CVE-2016-6023 enables directory traversal attacks that can lead to unauthorized access to sensitive files.

Is there a workaround for CVE-2016-6023?

There are no documented workarounds for CVE-2016-6023; patching to a secure version is recommended.