CVE-2016-9726: Input Validation

Published Mar 7, 2017

Updated

IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.

Affected Software

18 affected components

IBM QRadar Incident Forensics=7.2.0

IBM QRadar Incident Forensics=7.2.1

IBM QRadar Incident Forensics=7.2.2

IBM QRadar Incident Forensics=7.2.3

IBM QRadar Incident Forensics=7.2.4

IBM QRadar Incident Forensics=7.2.5

IBM QRadar Incident Forensics=7.2.6

IBM QRadar Incident Forensics=7.2.7

IBM QRadar Incident Forensics=7.2.8

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

IBM QRadar Security Information and Event Manager=7.2.5

IBM QRadar Security Information and Event Manager=7.2.6

IBM QRadar Security Information and Event Manager=7.2.7

IBM QRadar Security Information and Event Manager=7.2.8

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21999542

Event History

Mar 7, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9726?

CVE-2016-9726 is rated as high severity due to its potential to allow remote authenticated attackers to execute arbitrary commands.

How do I fix CVE-2016-9726?

To fix CVE-2016-9726, upgrade IBM QRadar Incident Forensics to version 7.2.8 or later, ensuring that all security patches are applied.

What versions of IBM QRadar are affected by CVE-2016-9726?

CVE-2016-9726 affects IBM QRadar Incident Forensics versions 7.2.0 to 7.2.7 and all versions of IBM QRadar Security Information and Event Manager from 7.2.0 to 7.2.8.

Can CVE-2016-9726 be exploited remotely?

Yes, CVE-2016-9726 can be exploited remotely by authenticated attackers to execute arbitrary commands.

What is the impact of CVE-2016-9726 on affected systems?

The impact of CVE-2016-9726 on affected systems includes the potential for unauthorized command execution, which can lead to data breaches or system compromise.