Security Bulletin
Summary
In certain situations after a specific error has been encountered and InfoSphere Information Server installation fails, sensitive data is recorded in a file. For releases 8.5 and earlier this vulnerability can occur only when updating an existing installation with maintenance. For releases 8.7and onwards, this vulnerability can occur when performing all types of installations including new installations, adding of components not previously installed and updating an existing installation with maintenance. If the installation does not fail no sensitive information will be recorded and there is no vulnerability.
Vulnerability Details
CVE ID: CVE-2013-5440
CVSS:
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87816 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Affected Products and Versions
IBM InfoSphere Information Server Versions 8.0, 8.1, 8.5, 8.7, and 9.1 running on all platforms
Remediation/Fixes
|
Product | VRMF | APAR | Remediation/First Fix |
| InfoSphere Information Server | 9.1 | JR48095 | Apply the IBM InfoSphere Information Server Installer Security Patch --Update the Unified Update Installer to the latest release. Note: Even after having taken these steps if the installation of an additional component to an existing installation fails you must re-apply the Security patch to ensure the sensitive data is removed. |
| InfoSphere Information Server | 8.7 | JR48095 | Apply the IBM InfoSphere Information Server Installer Security Patch --Update the Unified Update Installer to the latest release. Note: Even after having taken these steps if the installation of an additional component to an existing installation fails you must re-apply the Security patch to ensure the sensitive data is removed. |
| InfoSphere Information Server | 8.5 | JR48095 | Apply the IBM InfoSphere Information Server Installer Security Patch Update the 8.5 Updater to the latest release to avoid having to repeat the above steps after subsequent patch installs that encounter an exception. |
| InfoSphere Information Server | 8.0, 8.1 | none | Contact IBM customer support. |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
13 DECEMBER 2013 Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21659957