OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges
OpenSSL command line utility in IBM Workload Scheduler, installed in <TWS installation directory>/TWS/bin/openssl, is installed with SUID permssion, as showed below
-r-s--s--x 1 twsuser twsuser 2369776 Nov 22 11:01 openssl
For this reason the utility can run with elevated priviliges and users that are not typically allowed to see TWS configuration files can obtain read and write access to them.
DESCRIPTION: IBM Tivoli Workload Scheduler could disclose sensitive information to a local attacker due to improper permission settings.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier
APAR IJ02011 has been opened to address the openssl utility vulnerability for IBM Tivoli Workload Scheduler.
The apar will be fixed in the following fixpacks
For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.
Workarounds and Mitigations
To workaround this issue it is enough to change the permissions for openssl utility:
chmod 755 <TWS installation directory>/TWS/bin/openssl
Get Notified about Future Security Bulletins
The vulnerability was reported to IBM by David Lodge at Pen Test PArtners
24 Nov 2017: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
17 June 2018