CVE-2017-1179 Weak cryptography in BigFix Compliance Analytics

What is CVE-2017-1179?

CVE-2017-1179 is a medium-severity vulnerability in IBM BigFix Compliance Analytics, published on 8 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123431.

Weakness: CWE-326

Which versions are affected by CVE-2017-1179?

It affects 1 product.

Products include Ibm Bigfix Security Compliance Analytics.

How do I fix CVE-2017-1179?

No fix has been published for CVE-2017-1179 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-1179 being exploited?

There is no known exploitation of CVE-2017-1179 in the wild and no public exploit code.

Other vulnerabilities in IBM BigFix Compliance Analytics

• CVE-2017-1197 Security feature bypass in BigFix Compliance Analytics Critical 9.8
• CVE-2017-1196 Weak cryptography in Endpoint Manager for Security and Compliance Critical 9.8
• CVE-2017-1201 Hardcoded credentials in BigFix Compliance Analytics High 7.8
• CVE-2017-1178 Cross-site scripting in Endpoint Manager for Security and Compliance Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7m7f-v3gj-5795.