IBM Support

Security Bulletin: OpenSSL command line utility in IBM Workload Scheduler can run with elevated priviliges (CVE-2017-1716)

Security Bulletin


Summary

OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges

Vulnerability Details

OpenSSL command line utility in IBM Workload Scheduler, installed in <TWS installation directory>/TWS/bin/openssl, is installed with SUID permssion, as showed below
-r-s--s--x 1 twsuser twsuser 2369776 Nov 22 11:01 openssl
For this reason the utility can run with elevated priviliges and users that are not typically allowed to see TWS configuration files can obtain read and write access to them.

CVEID: CVE-2017-1716
DESCRIPTION:
IBM Tivoli Workload Scheduler could disclose sensitive information to a local attacker due to improper permission settings.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier

Remediation/Fixes

APAR IJ02011 has been opened to address the openssl utility vulnerability for IBM Tivoli Workload Scheduler.

The apar will be fixed in the following fixpacks

8.6.0-TIV-TWS-FP0005
9.1.0-TIV-TWS-FP0003
9.2.0-TIV-TWS-FP0003

For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.

Workarounds and Mitigations

To workaround this issue it is enough to change the permissions for openssl utility:

chmod 755 <TWS installation directory>/TWS/bin/openssl

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

The vulnerability was reported to IBM by David Lodge at Pen Test PArtners

Change History

24 Nov 2017: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"SSGSPN","label":"IBM Workload Scheduler"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Not Applicable","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"}],"Version":"8.6;9.1;9.2","Edition":"All Editions","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
17 June 2018

UID

swg22010947