^{CVE-2016-0250:}XML External Entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog allows authenticated users to read arbitrary files or cause denial of service.

Overview

The XML External Entity (XXE) vulnerability (CVE-2016-0250) affects IBM InfoSphere Information Governance Catalog, a data governance tool used for managing enterprise information assets. The vulnerability exists in versions 11.3 prior to 11.3.1.2 and 11.5 prior to 11.5.0.1. This security flaw occurs when the application processes XML input containing references to external entities without proper validation. An authenticated attacker could exploit this vulnerability to:

• Read arbitrary files on the system hosting the application
• Potentially access sensitive information
• Cause denial of service conditions
• Execute server-side request forgery attacks

The vulnerability requires authentication, which somewhat limits the attack surface, but still poses a significant risk to organizations using vulnerable versions of the software.

Remediation

To address this vulnerability, organizations should implement the following remediation steps:

1. Update IBM InfoSphere Information Governance Catalog to the following patched versions:

   • Version 11.3.1.2 or later if running 11.3
   • Version 11.5.0.1 or later if running 11.5

2. If immediate patching is not possible, consider these temporary mitigations:

   • Restrict access to the Information Governance Catalog to trusted users only
   • Monitor for suspicious XML-related activities in application logs
   • Implement network-level protections to limit access to the application

3. General XXE protection best practices:

   • Configure XML parsers to disable external entity processing
   • Implement proper input validation for all XML data
   • Use the latest security libraries and frameworks that handle XML processing

References

1. IBM Security Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21977152
2. IBM X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/110510
3. Common Weakness Enumeration (CWE-611): XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html