JR58241: SECURITY APAR CVE-2017-1539 GROUP MEMBERSHIPS OF SECURITY GROUPSARE SYNCHRONIZED WITH INTERNAL GROUPS THAT SHARE THE SAME NAME

bpm.8600.delta.repository
8.0.1.3-WS-BPM-IFJR58241
8.5.0.2-WS-BPM-IFJR58241
8.5.5.0-WS-BPM-IFJR58241
8.5.6.2-WS-BPM-IFJR58241
8.5.7.201706-WS-BPM-IFJR58241

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2017-1539
  DESCRIPTION: IBM Business Process Manager is vulnerable to
  privilege escalation by not properly distinguishing internal
  group memberships from user registry group memberships. By
  manipulating LDAP group membership an attack might gain
  privileged access.
  CVSS Base Score: 5
  CVSS Temporal Score:
  See https://exchange.xforce.ibmcloud.com/vulnerabilities/130807 
  for the current score
  CVSS Environmental Score*: Undefined
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
  
  PRODUCTS AFFECTED
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  

Local fix

Problem summary

• If a group in the user registry and an IBM BPM internal group
  share the same name, a user who is member of the user registry
  group is added as member of the internal group when he or she
  logs in. IBM BPM V8.5.7 CF 2017.06 contains a regression where
  the .roles method of a JavaScript TWUser object could cause a
  NullPointerException:
  
  JavaScriptRun E   CWLLG2015E:  An unexpected runtime exception
  occurred. See exception for more details.
  Error: Wrapped java.lang.NullPointerException (<JSScript>#11).
      org.mozilla.javascript.WrappedException: Wrapped
  java.lang.NullPointerException (<JSScript>#11)
   at
  org.mozilla.javascript.Context.throwAsScriptRuntimeEx(Context.ja
  va:1754)
   at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:148)
   at
  org.mozilla.javascript.ScriptableObject$GetterSlot.getValue(Scri
  ptableObject.java:295)
   at
  org.mozilla.javascript.ScriptableObject.get(ScriptableObject.jav
  a:456)
   at
  org.mozilla.javascript.ScriptableObject.getProperty(ScriptableOb
  ject.java:2185)
   at
  org.mozilla.javascript.ScriptRuntime.getObjectProp(ScriptRuntime
  .java:1492)
   at
  org.mozilla.javascript.ScriptRuntime.getObjectProp(ScriptRuntim.
  java:1485):
   Caused by: java.lang.NullPointerException
   at
  com.lombardisoftware.core.script.js.Utilities$RoleAdapter.getPro
  jectName(Utilities.java:2045)
   at
  com.lombardisoftware.core.script.js.Utilities.updateDisplayNames
  (Utilities.java:1912)
   at
  com.lombardisoftware.core.script.js.Utilities.updateUserGroups(U
  tilities.java:1881)
   at
  com.lombardisoftware.core.script.js.objects.UserScriptable.jsGet
  _roles(UserScriptable.java:298)
  

Problem conclusion

• A fix that prevents internal groups from being updated when
  users log in will be included in IBM BPM V7.5.12, V8.0.1.3,
  V8.5.0.2, V8.5.5.0, V8.5.6.0 CF02, and future releases. A fix is
   available for V8.5.7 cumulative fix 2017.06 that corrects this
  issue and the .roles NullPointerException regression introduced
  in IBM BPM V8.5.7 CF 2017.06.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels

• R857 PSY

     UP