CVE-2016-6116 - Vulnerability Details

Vendors	Products
Ibm	Security Key Lifecycle Manager

Link	Providers
http://www.ibm.com/support/docview.wss?uid=swg21997805
http://www.securityfocus.com/bid/95966

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Key Lifecycle Manager", "vendor": "IBM Corporation", "versions": [{"status": "affected", "version": "2.5"}, {"status": "affected", "version": "1.0"}, {"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.6"}]}], "datePublic": "2017-01-31T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-02-03T10:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21997805"}, {"name": "95966", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95966"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2016-6116", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Key Lifecycle Manager", "version": {"version_data": [{"version_value": "2.5"}, {"version_value": "1.0"}, {"version_value": "2.0"}, {"version_value": "2.0.1"}, {"version_value": "2.6"}]}}]}, "vendor_name": "IBM Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "http://www.ibm.com/support/docview.wss?uid=swg21997805", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg21997805"}, {"name": "95966", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95966"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:22:20.472Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21997805"}, {"name": "95966", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/95966"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-6116", "datePublished": "2017-02-02T22:00:00", "dateReserved": "2016-06-29T00:00:00", "dateUpdated": "2024-08-06T01:22:20.472Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Key Lifecycle Manager (string)

vendor : IBM Corporation (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.5 (string)

}

1 : { »

status : affected (string)

version : 1.0 (string)

}

2 : { »

status : affected (string)

version : 2.0 (string)

}

3 : { »

status : affected (string)

version : 2.0.1 (string)

}

4 : { »

status : affected (string)

version : 2.6 (string)

}

]

}

]

datePublic : 2017-01-31T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Obtain Information (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-02-03T10:57:01 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

}

1 : { »

name : 95966 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/95966 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

ID : CVE-2016-6116 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Key Lifecycle Manager (string)

version : { »

version_data : [ »

0 : { »

version_value : 2.5 (string)

}

1 : { »

version_value : 1.0 (string)

}

2 : { »

version_value : 2.0 (string)

}

3 : { »

version_value : 2.0.1 (string)

}

4 : { »

version_value : 2.6 (string)

}

]

}

]

}

vendor_name : IBM Corporation (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Obtain Information (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

refsource : CONFIRM (string)

url : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

}

1 : { »

name : 95966 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/95966 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-06T01:22:20.472Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

}

1 : { »

name : 95966 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/95966 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2016-6116 (string)

datePublished : 2017-02-02T22:00:00 (string)

dateReserved : 2016-06-29T00:00:00 (string)

dateUpdated : 2024-08-06T01:22:20.472Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "4E0E836F-4C4E-4630-9999-91B166DEABA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AE43784F-AEBE-4399-82C5-A339D9BCB676", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E57B0BB-2994-4A47-9C32-3DA982F23071", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "8FD5B68E-FB45-4985-96C7-6CFF3765E761", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "AF878AE8-D016-4546-84ED-5D65E21F833B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "81E86F00-E597-4C98-9863-05A4BA84D0A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "1BE7F6BA-BB8E-4249-81EE-EC8C617B48E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "CAA52325-CC9C-481A-8140-32C86608E2B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "F809CA96-9F05-4E58-91D0-9F05DC984D2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "6FAD90D4-0058-4DFB-8C72-DFBA3072C5C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "1D107CCC-476F-4453-BF41-B83923E5D695", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "DC7EB2EF-C7E1-4A44-9096-C3694BD5EBE3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}, {"lang": "es", "value": "IBM Tivoli Key Lifecycle Manager 2.5 y 2.6 podr\u00eda permitir a un atacante remoto obtener informaci\u00f3n sensible, provocado por el error al habilitar correctamente HTTP Strict Transport Security. Un atacante podr\u00eda explotar esta vulnerabilidad para obtener informaci\u00f3n sensible utilizando t\u00e9cnicas man-in-the-middle."}], "id": "CVE-2016-6116", "lastModified": "2024-11-21T02:55:29.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-02T22:59:00.353", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21997805"}, {"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/95966"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21997805"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/95966"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E0E836F-4C4E-4630-9999-91B166DEABA6 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : AE43784F-AEBE-4399-82C5-A339D9BCB676 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E57B0BB-2994-4A47-9C32-3DA982F23071 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 8FD5B68E-FB45-4985-96C7-6CFF3765E761 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : AF878AE8-D016-4546-84ED-5D65E21F833B (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 81E86F00-E597-4C98-9863-05A4BA84D0A4 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 1BE7F6BA-BB8E-4249-81EE-EC8C617B48E0 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.6:*:*:*:*:*:*:* (string)

matchCriteriaId : CAA52325-CC9C-481A-8140-32C86608E2B0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.7:*:*:*:*:*:*:* (string)

matchCriteriaId : F809CA96-9F05-4E58-91D0-9F05DC984D2F (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 6FAD90D4-0058-4DFB-8C72-DFBA3072C5C1 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 1D107CCC-476F-4453-BF41-B83923E5D695 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : DC7EB2EF-C7E1-4A44-9096-C3694BD5EBE3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. (string)

}

1 : { »

lang : es (string)

value : IBM Tivoli Key Lifecycle Manager 2.5 y 2.6 podría permitir a un atacante remoto obtener información sensible, provocado por el error al habilitar correctamente HTTP Strict Transport Security. Un atacante podría explotar esta vulnerabilidad para obtener información sensible utilizando técnicas man-in-the-middle. (string)

}

]

id : CVE-2016-6116 (string)

lastModified : 2024-11-21T02:55:29.247 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-02-02T22:59:00.353 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/95966 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21997805 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/95966 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object