CVE-2016-6042

IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim.

CVSS v3 7.3 HIGH
CVSS v2.0 9.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21995118	Patch Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21995118	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_appscan:9.0.0.0:::::::*
	cpe:2.3:a:ibm:security_appscan:9.0.0.1:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.1.0:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.1.1:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.2.0:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.2.1:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.3.0:-:enterprise:::::*
	cpe:2.3:a:ibm:security_appscan:9.0.3.1:-:enterprise:::::*

History

21 Nov 2024, 02:55

Type	Values Removed	Values Added
References	~~() http://www.ibm.com/support/docview.wss?uid=swg21995118 - Patch, Vendor Advisory~~	() http://www.ibm.com/support/docview.wss?uid=swg21995118 - Patch, Vendor Advisory

Information

Published : 2017-02-01 20:59

Updated : 2025-04-20 01:37

NVD link : CVE-2016-6042

Mitre link : CVE-2016-6042

CVE.ORG link : CVE-2016-6042

JSON object : View

Products Affected

ibm

security_appscan

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2016-6042", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2017-02-01T20:59:01.847", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg21995118", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg21995118", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim."}, {"lang": "es", "value": "IBM AppScan Enterprise Edition podr\u00eda permitir a un atacante remoto ejecutar c\u00f3digo arbitrario en el sistema, provocado por manipulaci\u00f3n indebida de objetos en memoria. Al persuadir a una v\u00edctima para abrir un contenido especialmente manipulado, un atacante podr\u00eda explotar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el sistema en el mismo contexto que la v\u00edctima."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6EEF97C-CAAC-4129-BDE8-244C0BBDCCFC"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "118F521C-ED24-4E17-85DF-7152D0457236"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.0:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "024248B4-12E7-4EDD-A965-2D7EE5CEBDA0"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.1:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC121336-C9B3-4BBE-9880-86DCF36940F7"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.0:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6626CF3-B513-4410-AF28-38C744BE723A"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.1:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C8408C0-271C-4576-A8E6-CC481EE0ABED"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.0:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32903FCA-B078-494F-BADF-E40B6FFCB2B5"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.1:-:enterprise:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "370F5DAB-5CDF-4D40-88F7-2C4509747BA8"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}