CVE-2016-0380
low
CVSS v3
3.3
CVSS v2
2.1
VIR risk
3.3
Description
IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.
Predictions
Exploit likelihood
34%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg21988278
Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg1IT14769
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | sterling_connect\ | direct | |
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT14769
- http://www-01.ibm.com/support/docview.wss?uid=swg21988278
- http://www.securityfocus.com/bid/92336
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT14769
- http://www-01.ibm.com/support/docview.wss?uid=swg21988278
- http://www.securityfocus.com/bid/92336
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.