Internet-facing relays in IBM BigFix deployments could lead to information disclosure and potential full remote compromise if not properly configured, Atredis Partners security researchers have discovered. Tracked as CVE-2019-4061 and affecting BigFix Platform versions 9.5 - 9.5.11 and 9.2 - 9.2.16, the vulnerability is found in all deployments where relays that are exposed to the Internet are not configured as authenticating. This misconfiguration could allow an unauthenticated, remote attacker to query the relay and gather information about the updates deployed to the associated sites. “Internet-facing relays, if any, in a BigFix deployment might be configured as non-authenticating, which exposes the deployment to security risks,” IBM notes in an advisory . “Security attacks in this context might mean unauthorized access to the relays and any content or actions, and download packages associated with them or to the Relay Diagnostics page that m...