Security Bulletin: A security vulnerability has been identified in BigFix Platform shipped with IBM Endpoint Manager for Software Use Analysis v2.2 (CVE-2016-6084)

Summary

BigFix Platform (BES Root Server and BES Relay) is shipped as a component of IBM Endpoint Manager for Software Use Analysis v2.2.
Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2016-6084
DESCRIPTION: BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.
CVSS Base Score: 7.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/117697&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Affected Products and Versions

IBM Endpoint Manager for Software Use Analysis v2.2

Remediation/Fixes

• Apply upgrade-patch fixlet for a BigFix Platform as described in the following technote: <http://www-01.ibm.com/support/docview.wss?uid=swg21996339&gt;

Workarounds and Mitigations

None