IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by inadequate account lockout setting (CVE-2016-6095)
IBM Security Key Lifecycle Manager allows attacker to conduct brute force dictionary attacks to bypass authentication because it is missing an account lockout mechanism.
CVE(s): CVE-2016-6095
Affected product(s) and affected version(s):
IBM Security Key Lifecycle Manager: v2.5 – 2.5.0.7
IBM Security Key Lifecycle Manager v2.6 – 2.6.0.2
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2jXz3yf
X-Force Database: http://ift.tt/2kVGh3y
from IBM Product Security Incident Response Team http://ift.tt/2jXkACi