CVE-2016-0380

IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.

CVSS v3 3.3 LOW
CVSS v2.0 2.1 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IT14769	Patch Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21988278	Mitigation Patch Vendor Advisory
http://www.securityfocus.com/bid/92336	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:sterling_connect\:direct:4.1.0.0:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.1.0.1:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.1.0.2:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.1.0.3:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.1.0.4:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.2.0.0:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.2.0.1:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.2.0.2:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.2.0.3:::::unix::
	cpe:2.3:a:ibm:sterling_connect\:direct:4.2.0.4:::::unix::

History

No history.

Information

Published : 2016-08-08 01:59

Updated : 2024-02-28 15:21

NVD link : CVE-2016-0380

Mitre link : CVE-2016-0380

CVE.ORG link : CVE-2016-0380

JSON object : View

Products Affected

ibm

sterling_connect\

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2016-0380", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2016-08-08T01:59:05.633", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT14769", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21988278", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/92336", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations."}, {"lang": "es", "value": "IBM Sterling Connect:Direct para Unix 4.1.0 en versiones anteriores a 4.1.0.4 iFix073 y 4.2.0 en versiones anteriores a 4.2.0.4 iFix003 utiliza permisos de archivo predeterminado de 0664, lo que permite a usuarios locales obtener informaci\u00f3n sensible a trav\u00e9s de operaciones est\u00e1ndares de sistema de archivos."}], "lastModified": "2020-06-25T19:42:45.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.1.0.0:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "015B9524-6932-4834-A3BB-985BB04C2FC3"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.1.0.1:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "4959E4CB-F87B-44CE-8FD2-F336DB1F4998"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.1.0.2:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "31CA7220-2523-4EDC-A98A-EA9DADE78EE6"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.1.0.3:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "166AA44D-1243-4F14-BF41-CD125D234AC2"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.1.0.4:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "281C2BEF-3C83-45C6-83EE-B5EE2B1BE817"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.2.0.0:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "B6EE8089-7D2A-479D-9DE4-0E0DAC8F2540"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.2.0.1:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "C7AE27EC-ED46-4B3F-9E4F-13FCA9A4E00E"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.2.0.2:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "CE00C5BB-3466-41AC-87DB-09C8E081643D"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.2.0.3:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "BD011827-8FE3-4C5C-9653-64FA90210B27"}, {"criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:4.2.0.4:*:*:*:*:unix:*:*", "vulnerable": true, "matchCriteriaId": "B9A75F26-B8CB-4EEB-A4B0-F11A9E48B1AD"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}