Medium Severity

IBM Security Bulletin: IBM Security Access Manager appliances are affected by multiple Network Time Protocol (NTP) vulnerabilities

Share this post:

IBM Security Access Manager has addressed the following vulnerabilities that have been identified in Network Time Protocol (NTP).

CVE(s): CVE-2016-7426, CVE-2016-7433, CVE-2016-9310, CVE-2016-9311, CVE-2016-7429

Affected product(s) and affected version(s):

Affected IBM Security Access Manager Appliance Affected Versions
IBM Security Access Manager for Web (appliance) 7.0 – 7.0.0.30
IBM Security Access Manager for Web 8.0 – 8.0.1.5
IBM Security Access Manager for Mobile 8.0 – 8.0.1.5
IBM Security Access Manager 9.0 – 9.0.2.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg22007067
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119094
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119095
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119087
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119086
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119093

More stories

Security Bulletin: IBM Maximo Asset Management is vulnerable to Privilege Escalation (CVE-2019-4530)

Nov 19, 2019 7:00 pm EST | Medium Severity

CVEID:   CVE-2019-4530 DESCRIPTION:   IBM Maximo Asset Management could allow an authenticated user to delete a record that they should not normally be able to.CVSS Base score: 4.3CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165586 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) ...read more


Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2019-4096)

Nov 15, 2019 7:00 pm EST | Medium Severity

CVEID:   CVE-2019-4046 DESCRIPTION:   IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM X-Force ID: 156242.CVSS Base score: 5.9CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/156242 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) ...read more


Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony

Nov 14, 2019 7:00 pm EST | Medium Severity

CVEID:   CVE-2019-16335 DESCRIPTION:   A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.CVSS Base score: 5.3CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/167205 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID:   CVE-2019-14379 DESCRIPTION:   SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.CVSS Base score: 9.8CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165286 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID:   CVE-2019-14439 DESCRIPTION:   A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.CVSS Base score: 5.3CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164744 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) ...read more