JR58580: VULNERABILITY IN USAGE OF DISKFILEITEM CLASS OF APACHE COMMONS FILEUPLOAD AFFECTS INFORMATION SERVER

Download ISF roll-up 9 for InfoSphere Information Server Version 11.5.0.2
Download ISF roll-up 8 for InfoSphere Information Server Version 11.3.1.2
Download ISF roll-up 13 for InfoSphere Information Server Version 9.1.2

APAR status

• Closed as program error.

Error description

• Vulnerability in usage of DiskFileItem class of Apache Commons
  FileUpload CVE-2016-1000031
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of Information Server components in various release
  streams
  ****************************************************************
  PROBLEM DESCRIPTION:
  Apache Commons FileUpload, as used in IBM InfoSphere Information
  Server, could allow a remote attacker to execute arbitrary code
  on the system, caused by deserialization of untrusted data in
  DiskFileItem class of the FileUpload library. A remote attacker
  could exploit this vulnerability to execute arbitrary code under
  the context of the current process.
  ****************************************************************
  RECOMMENDATION:
  Refer to Security bulletin
  www.ibm.com/support/docview.wss?uid=swg22010019 for actions to
  perform.
  ****************************************************************
  

Problem conclusion

• Upgrade Apache Commons FileUpload
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INFO SRVR PLATF

• Fixed component ID

  5724Q3612

Applicable component levels

• RB31 PSY

     UP

• RB50 PSY

     UP

• RB70 PSY

     UP