IBM Support

Security Bulletin: A vulnerable issue affects IBM Spectrum LSF Suite, IBM Spectrum LSF and IBM Spectrum LSF Suite Community Edition

Security Bulletin


Summary

There is a vulnerable issue in LSF that an attacker can exploit an authentication weakness in some messages transferred between some binaries through network, to run commands with unauthorized permission. LSF have addressed this security issue (CVE-2020-4983).

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)Version(s)
IBM Spectrum LSF Suite10.2
IBM Spectrum LSF10.1
IBM Spectrum LSF Suite Community Edition

10.2

Remediation/Fixes

Product

VRMF

APAR

Remediation/First Fix

Spectrum LSF Suite

10.2

None

1. Download IBM Spectrum LSF Suite 10.2 Fix Pack 11 from the following link, https://www.ibm.com/support/fixcentral

2. Apply the Fix Pack

A summary of the steps to apply this vulnerability fix is as follows :
1.    Shut down the LSF cluster.
2.    Update the binary files.
3.    Set LSF_STRICT_CHECKING=ENHANCED in the lsf.conf file.
4.    Start up the entire cluster.
5.    If using multiple clusters,  restart each cluster.

For detailed steps about enabling the parameter, see https://delivery04.dhe.ibm.com/sar/CMA/OSA/09e8q/1/Readme_BUILD564668.html

Spectrum LSF

10.1

None

1. Download IBM Spectrum LSF 10.1 Fix Pack 11 or Fix lsf-10.1-build564668 from the following link, https://www.ibm.com/support/fixcentral

2. Apply the Fix Pack

A summary of the steps to apply this vulnerability fix is as follows:
1.    Shut down the LSF cluster.
2.    Update the binary files.
3.    Set LSF_STRICT_CHECKING=ENHANCED in the lsf.conf file.
4.    Start up the entire cluster.
5.    If using multiple clusters,  restart each cluster.

For detailed steps about enabling the parameter, see https://delivery04.dhe.ibm.com/sar/CMA/OSA/09e8q/1/Readme_BUILD564668.html

Spectrum LSF Suite Community Edition

10.2

None

1. Download IBM Spectrum LSF CE 10.2 Fix Pack 11 from the following link, https://epwt-www.mybluemix.net/software/support/trial/cst/welcomepage.wss?siteId=680&tabId=1404&w=1

2. Apply the Fix Pack

A summary of the steps to apply this vulnerability fix is as follows:
1.    Shut down the LSF cluster.
2.    Update the binary files.
3.    Set LSF_STRICT_CHECKING=ENHANCED in the lsf.conf file.
4.    Start up the entire cluster.
5.    If using multiple clusters,  restart each cluster.

For detailed steps about enabling the parameter, see https://delivery04.dhe.ibm.com/sar/CMA/OSA/09e8q/1/Readme_BUILD564668.html

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

CVEID:  CVE-2020-4983
DESCRIPTION: IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary commands.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192586 for the current score.
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Acknowledgement

This vulnerability was reported to IBM by HPCsec

Change History

22 Dec 2020: Initial Publication
31 Jan 2020: Added LSF CE edition
11 May 2021: Updated with the steps to apply this LSF parameter fix for each version

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document Location

Worldwide

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSZU9Q","label":"IBM Spectrum LSF Suite for Workgroups"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.2","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSWRJV","label":"IBM Spectrum LSF"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
11 May 2021

UID

ibm16395478