IBM Support

Security Bulletin: IBM InfoSphere Information Server is vulnerable to root privilege escalation (CVE-2015-1900)

Security Bulletin


Summary

IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier.

Vulnerability Details

CVEID: CVE-2015-1900
DESCRIPTION:
IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files that could execute code with root privileges.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101637 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:S/C:C/I:C/A:C)

Affected Products and Versions

The following product, running on all supported platforms other than Windows, are affected:
IBM InfoSphere Information Server: versions 8.5, 8.7, 9.1 and 11.3

Remediation/Fixes

Product VRMF APAR Remediation/First Fix
InfoSphere Information Server 11.3 JR52770 --Apply IBM InfoSphere Information Server version 11.3.1.1 or
--Apply IBM InfoSphere Information Server version 11.3.1.2

--Apply IBM InfoSphere DataStage Security Patch
Note: Applying version 11.3.1.2 to a previously patched system requires the Security Patch to be reinstalled.
InfoSphere Information Server 9.1 JR52770 --Apply IBM InfoSphere Information Server version 9.1.2.0
--Apply IBM InfoSphere DataStage Security Patch
InfoSphere Information Server 8.7 JR52770 --Apply IBM InfoSphere Information Server version 8.7 Fix Pack 2
--Apply IBM InfoSphere DataStage Security Patch
InfoSphere Information Server 8.5 JR52770 --Apply IBM InfoSphere Information Server version 8.5 Fix Pack 3
--Apply IBM InfoSphere DataStage Security Patch*

*Users who previously installed JR42907, should not install the DataStage Security patch. Instead, contact IBM customer support to obtain an updated version of JR42907

Note: The same fix may be listed under multiple vulnerabilities. Installing the fix addresses all vulnerabilities to which the fix applies. Also, some fixes require installing both a fix pack and a subsequent patch. While the fix pack must be installed first, any additional patches required may be installed in any order.

For IBM InfoSphere Information Server version 8.1 IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Complete CVSS v2 Guide
On-line Calculator v2

Related information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

10 June 2015: Original Version Published
12 June 2015: Updated to include coverage for 11.3.1.2
18 June 2015: Corrected typo in Affected Products and Versions section
07 July 2015: Updated to publish fixes for 9.1.2
31 July 2015: Updated to publish fixes for 8.7, and expand scope of affected product
14 August 2015: Updated to publish fixes for 8.5

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information
Segment Product Component Platform Version Edition
Information Management InfoSphere Information Server AIX, HP-UX, Linux, Solaris, Windows 11.3, 8.5, 8.7, 9.1

Document information

More support for: InfoSphere Information Server

Software version: 8.5, 8.7, 9.1, 11.3

Operating system(s): AIX, HP-UX, Linux, Solaris

Reference #: 1902280

Modified date: 31 July 2015