Multiple vulnerabilities in IBM Cognos Command Center

1) Information disclosure

EUVDB-ID: #VU10125

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2579

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can partially access data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU10130

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2602

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded I18n component. A local attacker can partially access data, partially modify data, and partially deny service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security restrictions bypass

EUVDB-ID: #VU10131

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2603

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit Libraries component. A remote attacker can cause partial denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Privilege escalation

EUVDB-ID: #VU10135

Risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2633

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Java SE, Java SE Embedded, JRockit JNDI component. A remote attacker can gain system privileges on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security restrictions bypass

EUVDB-ID: #VU12354

Risk: Low

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1417

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to allowing untrusted code running under a security manager. A remote attacker can gain root privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security restrictions bypass

EUVDB-ID: #VU11946

Risk: Low

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2783

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE due to improper security restrictions. A remote attacker can create, delete or modify critical data or all Java SE, Java SE Embedded, JRockit accessible data and gain unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Privilege escalation

EUVDB-ID: #VU11948

Risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-2794

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists in the Java SE, JRockit component of Oracle Java SE due to improper security restrictions. A local attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Command Center: 10.2.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_cognos_command_center:10.2.4:*:*:*:*:*:*:*

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22016473&myns=swgimgmt&mynp=OCSSPLNP&mync=E&cm_sp=swgimgmt-_-OCSSPLNP-_-E

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.