Security Bulletin: A vulnerability in IBM Spectrum Scale could allow an authenticated user to gain elevated privileges (CVE-2020-9492)

Security Bulletin

Summary

A security vulnerability has been identified in all levels of IBM Spectrum Scale HDFS Transparency that could allow a remote authenticated user to gain elevated privileges. A fix for this vulnerability is available.

Vulnerability Details

CVEID: CVE-2020-9492
DESCRIPTION: Apache Hadoop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of SPNEGO authorization header. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to trigger services to send server credentials to a webhdfs path for capturing the service principal.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195656 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Spectrum Scale	5.0.0 - 5.0.5.6 (HDFS Transparency version - 3.1.1-5)
IBM Spectrum Scale	5.1.0 - 5.1.0.3 (HDFS Transparency version - 3.1.0-8)

Remediation/Fixes

For IBM Spectrum Scale V5.0.0 through 5.0.5.6, apply V5.0.5.7 (HDFS Transparency V3.1.1-5) or later available from FixCentral at:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=5.0.5&platform=All&function=all

For IBM Spectrum Scale V5.1.0.0 - V5.1.0.3, apply V5.1.1 (HDFS Transparency V3.1.0-8) or later available from FixCentral at:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=5.1.1&platform=All&function=all

If you cannot apply the latest level of service, contact IBM Service.

Workarounds and Mitigations

Workaround:

Set different http signature secrets and use dedicated hosts for each privileged impersonation service (such as HiveServer2).

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Acknowledgement

Change History

20 Apr 2021: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"STXKQY","label":"IBM Spectrum Scale"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"5.0, 5.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]

Tips

Security Bulletin: A vulnerability in IBM Spectrum Scale could allow an authenticated user to gain elevated privileges (CVE-2020-9492)