Security Bulletin: A security vulnerability has been identified in BigFix Platform shipped with IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-6082)

Summary

BigFix Platform (BES Root Server and BES Relay) is shipped as a component of IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x.
Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2016-6082
DESCRIPTION: BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117562 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

IBM License Metric Tool v9.x IBM BigFix Inventory v9.x

Remediation/Fixes

• Apply upgrade-patch fixlet for a BigFix Platform as described in the following technote:
  <http://www-01.ibm.com/support/docview.wss?uid=swg21996375&gt;

Workarounds and Mitigations

None