IBM Support

Security Bulletin: IBM QRadar Wincollect agent is vulnerable to information disclosure

Security Bulletin


Summary

The IBM QRadar Wincollect standalone agent is vulnerable to sensitive information disclosure due to missing best practices.

Vulnerability Details

CVEID:   CVE-2021-39006
DESCRIPTION:   IBM QRadar WinCollect Agent could allow an attacker to obtain sensitive information due to missing best practices.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213549 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)Version(s)
QRadar WinCollect Agent10.0 - 10.0.1

Remediation/Fixes

IBM recommends customers upgrade their systems promptly.

There is a new upgrade for the Wincollect standalone agent. The following Wincollect standalone agent versions can be used to upgrade the affected versions to resolve the vulnerability. For information on how to upgrade your WinCollect version, see the WinCollect 10.0.2 release notes: https://www.ibm.com/support/pages/node/6523772

Download and install the Wincollect standalone agent version 10.0.2:

WinCollect Agent MSI (64-bit) - Standalone only: https://www.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=7.5.0-QRADAR-AGENT-wincollect-10.0.2-62.x64.msi&continue=1

WinCollect Agent MSI (32-bit) - Standalone only: https://www.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=7.5.0-QRADAR-AGENT-wincollect-10.0.2-62.x86.msi&continue=1

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

John Zuccato, Rodney Ryan, Chris Shepherd, Nathan Roane, Vince Dragnea, Troy Fisher, Gabor Minyo, Geoffrey Owden, and Ben Goodspeed from the IBM Security Ethical Hacking Team.

Change History

16 Jun 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
20 June 2022

UID

ibm16596947