CVE-2016-8964
critical
CVSS v3
9.8
CVSS v2
5.0
VIR risk
9.8
Description
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — https://exchange.xforce.ibmcloud.com/vulnerabilities/118853
Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg21995024
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | bigfix_inventory | {"startIncluding":"9.0","endExcluding":"9.2.8"} | 9.2.8 |
| ibm | license_metric_tool | {"startIncluding":"9.0","endExcluding":"9.2.8"} | 9.2.8 |
References
- http://www.ibm.com/support/docview.wss?uid=swg21995024
- http://www.securityfocus.com/bid/99548
- http://www.securitytracker.com/id/1038919
- https://exchange.xforce.ibmcloud.com/vulnerabilities/118853
- http://www.ibm.com/support/docview.wss?uid=swg21995024
- http://www.securityfocus.com/bid/99548
- http://www.securitytracker.com/id/1038919
- https://exchange.xforce.ibmcloud.com/vulnerabilities/118853
CWEs
CWE-200 CWE-254
Verify integrity in audit chain (admin only). AS-IS.