IBM Support

Security Bulletin: A vulnerable issue affects IBM Spectrum LSF Suite, IBM Spectrum LSF and IBM Spectrum LSF Suite Community Edition

Security Bulletin


Summary

There is a vulnerable issue in LSF that an attacker can exploit an authentication weakness in some messages transferred between some binaries through network, to run commands with unauthorized permission. LSF have addressed this security issue.

Vulnerability Details

CVEID: CVE-2020-4983
Description: IBM Spectrum LSF Suite could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary commands
CVSS Base Score: 7.4
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/192586 for more information
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Spectrum LSF Suite 10.2
IBM Spectrum LSF 10.1
IBM Spectrum LSF Suite Community Edition 10.2

Remediation/Fixes

Product

VRMF

APAR

Remediation/First Fix

Spectrum LSF Suite

10.2

None

1. Download IBM Spectrum LSF Suite 10.2 Fix Pack 11 from following link, https://www.ibm.com/support/fixcentral

2. Apply the Fix Pack follow by the Read Me

Spectrum LSF

10.1

None

1. Download IBM Spectrum LSF 10.1 Fix Pack 11 or Fix lsf-10.1-build564668 from following link, https://www.ibm.com/support/fixcentral

2. Apply the Fix Pack/Patch follow by the Read Me

Spectrum LSF Suite Community Edition

10.2

None

1. Download IBM Spectrum LSF CE 10.1 Fix Pack 11 from following link, https://epwt-www.mybluemix.net/software/support/trial/cst/welcomepage.wss?siteId=680&tabId=1404&w=1

2. Apply the Fix Pack/Patch follow by the Read Me

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

This vulnerability was reported to IBM by HPCsec

Change History

22 Dec 2020: Initial Publication
31 Jan 2020: Add LSF CE edition

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document Location

Worldwide

[{"Business Unit":{"code":"BU029","label":"Data and AI"},"Product":{"code":"SSZU9Q","label":"IBM Spectrum LSF Suite for Workgroups"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.2","Edition":""},{"Business Unit":{"code":"BU029","label":"Data and AI"},"Product":{"code":"SSWRJV","label":"IBM Spectrum LSF"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.1","Edition":""}]

Document Information

Modified date:
01 February 2021

UID

ibm16395478