IBM BigFix Platform Multiple Security Vulnerabilities

Bugtraq ID:	101571
Class:	Input Validation Error
CVE:	CVE-2017-1218 CVE-2017-1225 CVE-2017-1232 CVE-2017-1220 CVE-2017-1230 CVE-2017-1521 CVE-2017-1228 CVE-2017-1226 CVE-2017-1222
Remote:	Yes
Local:	No
Published:	Oct 24 2017 12:00AM
Updated:	Oct 24 2017 12:00AM
Credit:	Ron Craig, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza and William Easton of Strawgate, LLC.
Vulnerable:	IBM BigFix Platform 9.5 IBM BigFix Platform 9.2
Not Vulnerable:

IBM BigFix Platform Multiple Security Vulnerabilities

IBM BigFix Platform is prone to the following multiple security vulnerabilities:

1. Multiple information-disclosure vulnerabilities
2. security-Bypass vulnerability
3. A cross-site-scripting vulnerability
4. A cross-site request-forgery vulnerability

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials, perform unauthorized actions or obtain sensitive information.

BigFix Platform versions 9.5 and 9.2 are vulnerable.

IBM BigFix Platform Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM BigFix Platform Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM BigFix Platform Multiple Security Vulnerabilities

References:

• IBM Homepage (IBM)
  
• swg22009673:The BigFix Platform has vulnerabilities that have been addressed in (IBM)