Security Bulletin: Multiple vulnerabilities found in IBM QRadar SIEM and QRadar Risk Manager (CVE-2014-4832, CVE-2014-4831, CVE-2014-4829, CVE-2014-4829, CVE-2014-6075)

Summary

There are multiple security vulnerabilities in various components used by IBM QRadar in versions 7.1 MR2 and 7.2.3.

Vulnerability Details

CVEID:CVE-2014-4832

Description: A vulnerability in the IBM QRadar Risk Manager application could allow a remote attacker to obtain sensitive information. If the application is accessed via a network with HTTP, an attacker using man-in-the-middle techniques could recover packets for non-encrypted cookies that could potentially contain sensitive session information or credentials.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95582 for the current score
CVSS Environmental Score:*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID: CVE-2014-4831

Description: IBM QRadar Risk Manager could allow a remote attacker to hijack a valid user’s session, caused by improper validation. A remote attacker could exploit this vulnerability to hijack another user’s account and gain the victim’s privileges.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95581 for the current score
CVSS Environmental Score:*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-4829

Description: IBM QRadar is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95579 for the current score
CVSS Environmental Score:*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-6075

Description: IBM Qradar Risk Manager generates URLs with exposed user credentials in cleartext. A malicious user could obtain the exposed credentials in browser history and log files.

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95727 for the current score
CVSS Environmental Score:*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Affected Products and Versions

• • IBM QRadar SIEM 7.2.3 Patch 4 and below.
• IBM QRadar SIEM 7.1 MR2 Patch 8 and below.
• IBM QRadar Vulnerability Manager 7.2.3 Patch 4 and below.
• IBM QRadar Risk Manager 7.2.3 Patch 4 and below.
• IBM QRadar Risk Manager 7.1 MR2 Patch 8 and below.

Remediation/Fixes

Product

| Remediation/First Fix
—|—

• IBM QRadar SIEM 7.2.3

• IBM QRadar Vulnerability Manager 7.2.3

• IBM QRadar Risk Manager 7.2.3
  | IBM QRadar SIEM 7.2.4 Patch 1

• IBM QRadar SIEM 7.1 MR2

• IBM QRadar Risk Manager 7.1 MR2
  | IBM QRadar SIEM 7.1 MR2 Patch 9

Workarounds and Mitigations

None

**