cnvd - cnvd-2017-03156

CNVD-2017-03156

Vulnerability from cnvd - Published: 2017-03-23

Title

IBM QRadar SIEM拒绝服务漏洞

Description

IBM QRadar SIEM是美国IBM公司的一套利用安全智能保护资产和信息远离高级威胁的解决方案。该方案提供对整个IT架构范围进行监督、生成详细的数据访问和用户活动报告等功能。 IBM QRadar SIEM拒绝服务漏洞。允许攻击者可利用该漏洞造成拒绝服务。

Severity

高

Patch Name

IBM QRadar SIEM拒绝服务漏洞的补丁

Patch Description

IBM QRadar SIEM是美国IBM公司的一套利用安全智能保护资产和信息远离高级威胁的解决方案。该方案提供对整个IT架构范围进行监督、生成详细的数据访问和用户活动报告等功能。 IBM QRadar SIEM拒绝服务漏洞。允许攻击者利用该漏洞造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新: http://www-01.ibm.com/support/docview.wss?uid=swg21999556

Reference

http://www.securityfocus.com/bid/96535 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9740

Impacted products

Name
['IBM QRadar Security Information and Event Manager 7.2.2', 'IBM QRadar Security Information and Event Manager 7.2.7', 'IBM QRadar Security Information and Event Manager 7.2.6', 'IBM QRadar Security Information and Event Manager 7.2.4', 'IBM QRadar Security Information and Event Manager 7.2.3', 'IBM QRadar Security Information and Event Manager 7.2.1', 'IBM QRadar Security Information and Event Manager 7.2.0', 'IBM QRadar Security Information and Event Manager 7.2.5', 'IBM QRadar Security Information and Event Manager 7.2.8']

Name

['IBM QRadar Security Information and Event Manager 7.2.2', 'IBM QRadar Security Information and Event Manager 7.2.7', 'IBM QRadar Security Information and Event Manager 7.2.6', 'IBM QRadar Security Information and Event Manager 7.2.4', 'IBM QRadar Security Information and Event Manager 7.2.3', 'IBM QRadar Security Information and Event Manager 7.2.1', 'IBM QRadar Security Information and Event Manager 7.2.0', 'IBM QRadar Security Information and Event Manager 7.2.5', 'IBM QRadar Security Information and Event Manager 7.2.8']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96535"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-9740",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9740"
    }
  },
  "description": "IBM QRadar SIEM\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5229\u7528\u5b89\u5168\u667a\u80fd\u4fdd\u62a4\u8d44\u4ea7\u548c\u4fe1\u606f\u8fdc\u79bb\u9ad8\u7ea7\u5a01\u80c1\u7684\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u63d0\u4f9b\u5bf9\u6574\u4e2aIT\u67b6\u6784\u8303\u56f4\u8fdb\u884c\u76d1\u7763\u3001\u751f\u6210\u8be6\u7ec6\u7684\u6570\u636e\u8bbf\u95ee\u548c\u7528\u6237\u6d3b\u52a8\u62a5\u544a\u7b49\u529f\u80fd\u3002\r\n\r\nIBM QRadar SIEM\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Paul Ionescu, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza of IBM.",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0:\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21999556",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-03156",
  "openTime": "2017-03-23",
  "patchDescription": "IBM QRadar SIEM\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5229\u7528\u5b89\u5168\u667a\u80fd\u4fdd\u62a4\u8d44\u4ea7\u548c\u4fe1\u606f\u8fdc\u79bb\u9ad8\u7ea7\u5a01\u80c1\u7684\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u63d0\u4f9b\u5bf9\u6574\u4e2aIT\u67b6\u6784\u8303\u56f4\u8fdb\u884c\u76d1\u7763\u3001\u751f\u6210\u8be6\u7ec6\u7684\u6570\u636e\u8bbf\u95ee\u548c\u7528\u6237\u6d3b\u52a8\u62a5\u544a\u7b49\u529f\u80fd\u3002\r\n\r\nIBM QRadar SIEM\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM QRadar SIEM\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM QRadar Security Information and Event Manager 7.2.2",
      "IBM QRadar Security Information and Event Manager 7.2.7",
      "IBM QRadar Security Information and Event Manager 7.2.6",
      "IBM QRadar Security Information and Event Manager 7.2.4",
      "IBM QRadar Security Information and Event Manager 7.2.3",
      "IBM QRadar Security Information and Event Manager 7.2.1",
      "IBM QRadar Security Information and Event Manager 7.2.0",
      "IBM QRadar Security Information and Event Manager 7.2.5",
      "IBM QRadar Security Information and Event Manager 7.2.8"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/96535\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9740",
  "serverity": "\u9ad8",
  "submitTime": "2017-03-07",
  "title": "IBM QRadar SIEM\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2016-9740 (GCVE-0-2016-9740)

Vulnerability from cvelistv5 – Published: 2017-03-07 17:00 – Updated: 2024-08-06 02:59

Summary

IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556.

Severity ?

No CVSS data available.

CWE

Denial of Service

Assigner

ibm

References

URL

Tags

	http://www.securityfocus.com/bid/96535	vdb-entryx_refsource_BID
	http://www.ibm.com/support/docview.wss?uid=swg21999556	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	IBM Corporation	QRadar SIEM	Affected: 7.1 MR1 Affected: 7.1 Affected: 7.0 Affected: 7.2 Affected: 7.1 MR2 Affected: 7 Affected: 7.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:59:03.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96535",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96535"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg21999556"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QRadar SIEM",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "7.1 MR1"
            },
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "status": "affected",
              "version": "7.1 MR2"
            },
            {
              "status": "affected",
              "version": "7"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            }
          ]
        }
      ],
      "datePublic": "2017-02-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-08T10:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "96535",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96535"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg21999556"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-9740",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QRadar SIEM",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.1 MR1"
                          },
                          {
                            "version_value": "7.1"
                          },
                          {
                            "version_value": "7.0"
                          },
                          {
                            "version_value": "7.2"
                          },
                          {
                            "version_value": "7.1 MR2"
                          },
                          {
                            "version_value": "7"
                          },
                          {
                            "version_value": "7.1 MR2"
                          },
                          {
                            "version_value": "7.2.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96535",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96535"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg21999556",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg21999556"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-9740",
    "datePublished": "2017-03-07T17:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-06T02:59:03.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-03156

CVE-2016-9740 (GCVE-0-2016-9740)

Tags

Sightings

Nomenclature