IBM Support

Security Bulletin: IBM InfoSphere Information Server is vulnerable to root privilege escalation (CVE-2015-1900)

Security Bulletin


Summary

IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier.

Vulnerability Details

CVEID: CVE-2015-1900
DESCRIPTION:
IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files that could execute code with root privileges.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101637 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:C/I:C/A:C)

Affected Products and Versions

The following product, running on all supported platforms other than Windows, are affected:
IBM InfoSphere Information Server: versions 8.5, 8.7, 9.1 and 11.3

Remediation/Fixes

Product

VRMFAPARRemediation/First Fix
InfoSphere Information Server11.3JR52770--Apply IBM InfoSphere Information Server version 11.3.1.1 or
--Apply IBM InfoSphere Information Server version 11.3.1.2

--Apply IBM InfoSphere DataStage Security Patch
Note: Applying version 11.3.1.2 to a previously patched system requires the Security Patch to be reinstalled.
InfoSphere Information Server9.1JR52770--Apply IBM InfoSphere Information Server version 9.1.2.0
--Apply IBM InfoSphere DataStage Security Patch
InfoSphere Information Server8.7JR52770--Apply IBM InfoSphere Information Server version 8.7 Fix Pack 2
--Apply IBM InfoSphere DataStage Security Patch
InfoSphere Information Server8.5JR52770--Apply IBM InfoSphere Information Server version 8.5 Fix Pack 3
--Apply IBM InfoSphere DataStage Security Patch*

*Users who previously installed JR42907, should not install the DataStage Security patch. Instead, contact IBM customer support to obtain an updated version of JR42907

Note: The same fix may be listed under multiple vulnerabilities. Installing the fix addresses all vulnerabilities to which the fix applies. Also, some fixes require installing both a fix pack and a subsequent patch. While the fix pack must be installed first, any additional patches required may be installed in any order.

For IBM InfoSphere Information Server version 8.1 IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

10 June 2015: Original Version Published
12 June 2015: Updated to include coverage for 11.3.1.2
18 June 2015: Corrected typo in Affected Products and Versions section
07 July 2015: Updated to publish fixes for 9.1.2
31 July 2015: Updated to publish fixes for 8.7, and expand scope of affected product
14 August 2015: Updated to publish fixes for 8.5

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Internal Use Only

PSIRT 51840

[{"Product":{"code":"SSZJPZ","label":"InfoSphere Information Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"}],"Version":"9.1;8.7;8.5;11.3","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSZJPZ","label":"InfoSphere Information Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":" ","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"11.3;8.5;8.7;9.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
16 June 2018

UID

swg21902280