Security Bulletin
Summary
IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier.
Vulnerability Details
CVEID: CVE-2015-1900
DESCRIPTION: IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files that could execute code with root privileges.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101637 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:C/I:C/A:C)
Affected Products and Versions
The following product, running on all supported platforms other than Windows, are affected:
IBM InfoSphere Information Server: versions 8.5, 8.7, 9.1 and 11.3
Remediation/Fixes
|
Product | VRMF | APAR | Remediation/First Fix |
| InfoSphere Information Server | 11.3 | JR52770 | --Apply IBM InfoSphere Information Server version 11.3.1.1 or --Apply IBM InfoSphere Information Server version 11.3.1.2 --Apply IBM InfoSphere DataStage Security Patch Note: Applying version 11.3.1.2 to a previously patched system requires the Security Patch to be reinstalled. |
| InfoSphere Information Server | 9.1 | JR52770 | --Apply IBM InfoSphere Information Server version 9.1.2.0 --Apply IBM InfoSphere DataStage Security Patch |
| InfoSphere Information Server | 8.7 | JR52770 | --Apply IBM InfoSphere Information Server version 8.7 Fix Pack 2 --Apply IBM InfoSphere DataStage Security Patch |
| InfoSphere Information Server | 8.5 | JR52770 | --Apply IBM InfoSphere Information Server version 8.5 Fix Pack 3 --Apply IBM InfoSphere DataStage Security Patch* *Users who previously installed JR42907, should not install the DataStage Security patch. Instead, contact IBM customer support to obtain an updated version of JR42907 |
Note: The same fix may be listed under multiple vulnerabilities. Installing the fix addresses all vulnerabilities to which the fix applies. Also, some fixes require installing both a fix pack and a subsequent patch. While the fix pack must be installed first, any additional patches required may be installed in any order.
For IBM InfoSphere Information Server version 8.1 IBM recommends upgrading to a fixed, supported version/release/platform of the product.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
10 June 2015: Original Version Published
12 June 2015: Updated to include coverage for 11.3.1.2
18 June 2015: Corrected typo in Affected Products and Versions section
07 July 2015: Updated to publish fixes for 9.1.2
31 July 2015: Updated to publish fixes for 8.7, and expand scope of affected product
14 August 2015: Updated to publish fixes for 8.5
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
PSIRT 51840
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21902280