Security Bulletin: IBM InfoSphere Information Server sometimes records sensitive data when an installation fails (CVE-2013-5440)

Security Bulletin


Summary

In certain situations after a specific error has been encountered and InfoSphere Information Server installation fails, sensitive data is recorded in a file. For releases 8.5 and earlier this vulnerability can occur only when updating an existing installation with maintenance. For releases 8.7and onwards, this vulnerability can occur when performing all types of installations including new installations, adding of components not previously installed and updating an existing installation with maintenance. If the installation does not fail no sensitive information will be recorded and there is no vulnerability.

Vulnerability Details

CVE ID: CVE-2013-5440
CVSS:
CVSS Base Score: 2.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87816 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products

IBM InfoSphere Information Server Versions 8.0, 8.1, 8.5, 8.7, and 9.1 running on all platforms

Remediation/Fixes


Product

VRMF

APAR

Remediation/First Fix

InfoSphere Information Server

9.1

JR48095

Apply the IBM InfoSphere Information Server Installer Security Patch
--Update the Unified Update Installer to the latest release.
Note: Even after having taken these steps if the installation of an additional component to an existing installation fails you must re-apply the Security patch to ensure the sensitive data is removed.

InfoSphere Information Server

8.7

JR48095

Apply the IBM InfoSphere Information Server Installer Security Patch
--Update the Unified Update Installer to the latest release.
Note: Even after having taken these steps if the installation of an additional component to an existing installation fails you must re-apply the Security patch to ensure the sensitive data is removed.

InfoSphere Information Server

8.5

JR48095

Apply the IBM InfoSphere Information Server Installer Security Patch
Update the 8.5 Updater to the latest release to avoid having to repeat the above steps after subsequent patch installs that encounter an exception.

InfoSphere Information Server

8.0, 8.1

none

Contact IBM customer support.

Workarounds/Mitigations

None

References:

Complete CVSS Guide
On-line Calculator V2

Related information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

13 DECEMBER 2013 Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Document information


More support for:

InfoSphere Information Server

Software version:

8.0.1, 8.1, 8.5, 8.7, 9.1

Operating system(s):

AIX, HP-UX, Linux, Solaris, Windows

Reference #:

1659957

Modified date:

2013-12-13

Translate my page

Machine Translation

Content navigation