IBM Support

Security Bulletin: GNU C library (glibc) vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, and 5710 (CVE-2015-0235)

Created by David Tam on
Published URL:
https://www.ibm.com/support/pages/node/526097
526097

Security Bulletin


Summary

GNU C library (glibc) vulnerability that has been referred to as GHOST affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, and 5710.

Vulnerability Details

CVEID: CVE-2015-0235

DESCRIPTION:The gethostbyname functions of the GNU C Library (glibc) are vulnerable to a buffer overflow. By sending a specially crafted, but valid hostname argument, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the targeted process or cause the process to crash. The impact of an attack depends on the implementation details of the targeted application or operating system. This issue is being referred to as the "Ghost" vulnerability.

CVSS Base Score: 7.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100386 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM InfoSphere Balanced Warehouse C3000 for Linux
IBM InfoSphere Balanced Warehouse C4000 for Linux
IBM Smart Analytics System 1050 for Linux
IBM Smart Analytics System 2050 for Linux
IBM Smart Analytics System 5600
IBM Smart Analytics System 5710

Remediation/Fixes

For each affected component in the table, download the recommended fix, and install using the link in the Installation Instructions column.

For more information about IBM IDs, see the Help and FAQ.

IBM InfoSphere Balanced Warehouse C3000 and C4000 for Linux
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 10Update glibc to 2.4-31.113.3Novell: Patch 9035Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 1050 and 2050 for Linux
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.74.13Novell: Patch 10206Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 5600 V1 and V2
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.45.55.5Novell: Patch 10204Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 5600 V3
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.45.55.5Contact IBM Support
IBM Smart Analytics System 5710
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.74.13Novell: Patch 10206Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment


Once updates have been applied, any process using glibc will need to be restarted. Given that nearly all system processes use glibc, rebooting after upgrading is suggested.

IBM recommends that you review your entire environment to identify vulnerable releases of glibc including your Operating Systems and take appropriate mitigation and remediation actions. Please contact your Operating System provider for more information.


For assistance, contact IBM Support:

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

February 9, 2015: Added remediation for IBM Smart Analytics System 5600.
February 5, 2015: Original version published.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

IBM InfoSphere Balanced Warehouse C3000 and C4000 for Linux

Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 10Update glibc to 2.4-31.113.3Novell: Patch 9035Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 1050 and 2050 for Linux
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.74.13Novell: Patch 10206Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 5600 V1 and V2
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.45.55.5Novell: Patch 10204Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment
IBM Smart Analytics System 5600 V3
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.45.55.5Contact IBM Support
IBM Smart Analytics System 5710
Affected ComponentRecommended FixDownload LinkInstallation Instructions
SUSE Linux Enterprise Server 11Update glibc to 2.11.3-17.74.13Novell: Patch 10206Installing a SUSE Linux Enterprise Server update in a Balanced Warehouse or IBM Smart Analytics System or Balanced Warehouse environment

[{"Product":{"code":"SSFVXC","label":"InfoSphere Balanced Warehouse"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Balanced Warehouse C Class - C3000","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSFVXC","label":"InfoSphere Balanced Warehouse"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Balanced Warehouse C Class - C4000","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 1050","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 2050","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 5710","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 5600","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7;10.1","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
16 June 2018

UID

swg21696234

Page Feedback