IBM Support

Security Bulletin: Multiple security vulnerabilities have been identified in IBM® General Parallel File System shipped with IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System for Operational Analytics

Created by Gregg Snodgrass on
Published URL:
https://www.ibm.com/support/pages/node/532855
532855

Security Bulletin


Summary

IBM General Parallel File System is shipped as a component of IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System for Operational Analytics. Information about a security vulnerability affecting IBM General Parallel File System has been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2015-0197

DESCRIPTION: IBM General Parallel File System could allow a local attacker which only has a non-privileged account to execute programs with root privileges.

CVSS Base Score: 6.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101224 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0199

DESCRIPTION: IBM General Parallel File System allows attackers to cause kernel memory corruption by issuing specific ioctl calls to a character device provided by the mmfslinux kernel module and escalate privileges or cause a denial of service.

CVSS Base Score: 6.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101226 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0198

DESCRIPTION: IBM General Parallel File System may not properly authenticate network requests and could allow an attacker to execute programs remotely with root privileges.

CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101225 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM Smart Analytics System 7600
IBM Smart Analytics System 7700
IBM Smart Analytics System 7710
IBM PureData System for Operational Analytics V1.0 (A1791)
IBM PureData System for Operational Analytics V1.1 (A1801)

Remediation/Fixes

For each affected component in the table, download the recommended fix, and install using the link in the Installation instructions column.

For more information about IBM IDs, see the Help and FAQ.

IBM Smart Analytics System 7600, 7700 and 7710
Affected ComponentRecommended FixDownload LinkInstallation Instructions
IBM General Parallel File SystemUpgrade to GPFS V3.5.0.24See installation instructions.http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062
IBM PureData System for Operational Analytics V1.0 (A1791)
Affected ComponentRecommended FixDownload LinkInstallation Instructions
IBM General Parallel File SystemInstall IBM PureData System for Operational Analytics Fix Pack V1.0.0.4 then upgrade to GPFS V4.1.0.8GPFS 4.1.0.8 Link In IBM Fix CentralHow to apply a GPFS fixpack in a PureData System for Operational Analytics Environment.
IBM PureData System for Operational Analytics V1.1 (A1801)
Affected ComponentRecommended FixDownload LinkInstallation Instructions
IBM General Parallel File SystemUpgrade to GPFS V4.1.0.8GPFS 4.1.0.8 Link In IBM Fix CentralHow to apply a GPFS fixpack in a PureData System for Operational Analytics Environment.

For assistance, contact IBM Support:

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

August 10, 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

NOTES: If you download *.gz from chrome from fix central it may uncompress the file automatically but it won't change the extension.
Advisory 3033

2015-08-04: Updated document to use GPFS 4.1.0.8 which is the latest available.
2015-08-04: Added a link to a new GPFS Update Technote (1963819) for PDOA environments.
Internal link is: http://g01zciwas018.ahe.pok.ibm.com/support/dcf/preview.wss?host=g01zcidbs003.ahe.pok.ibm.com&db=support/swg/dmgtech.nsf&unid=4C090AE3AC10DD9485257E97005F3C3B&taxOC=SSH2TE&MD=2015/08/04%2014:08:12&sid=

[{"Product":{"code":"SSH2TE","label":"PureData System for Operational Analytics A1801"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":["Not Applicable","Not Applicable"],"Platform":[{"code":"PF002","label":"AIX"}],"Version":"1.0;1.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7600","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7700","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7;10.1","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7710","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
17 October 2019

UID

swg21962616

Page Feedback