Preface – You never know what will be happened tomorrow.

Synopsis: A vulnerability in IBM Tivoli Netcool Impact could allow an authenticated, adjacent attacker to execute arbitrary commands on a targeted system.

Vulnerability details: A vulnerability in IBM Tivoli Netcool Impact could allow an authenticated, adjacent attacker to execute arbitrary commands on a targeted system.At the time this alert was first published, the exploit vector was unknown due to vendor not disclosed the details.We believe that IBM Tivoli Netcool Impact 7.1 has encountered the open source vulnerabilities. The defect might be caused by CVE-2015-0227. Apache WSS4J could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce the requireSignedEncryptedDataElements property. An attacker could exploit this vulnerability using various types of wrapping attacks to bypass security restrictions and perform unauthorized actions.

IBM has released software updates at the following link: https://www-01.ibm.com/support/docview.wss?uid=ibm10881009