Security Bulletin: OpenSSL command line utility in IBM Workload Scheduler can run with elevated priviliges (CVE-2017-1716)

Security Bulletin

Summary

OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges

Vulnerability Details

OpenSSL command line utility in IBM Workload Scheduler, installed in <TWS installation directory>/TWS/bin/openssl, is installed with SUID permssion, as showed below
-r-s--s--x 1 twsuser twsuser 2369776 Nov 22 11:01 openssl
For this reason the utility can run with elevated priviliges and users that are not typically allowed to see TWS configuration files can obtain read and write access to them.

CVEID: CVE-2017-1716
DESCRIPTION: IBM Tivoli Workload Scheduler could disclose sensitive information to a local attacker due to improper permission settings.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier

Remediation/Fixes

APAR IJ02011 has been opened to address the openssl utility vulnerability for IBM Tivoli Workload Scheduler.

The apar will be fixed in the following fixpacks

8.6.0-TIV-TWS-FP0005
9.1.0-TIV-TWS-FP0003
9.2.0-TIV-TWS-FP0003

For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.

Workarounds and Mitigations

To workaround this issue it is enough to change the permissions for openssl utility:

chmod 755 <TWS installation directory>/TWS/bin/openssl

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Acknowledgement

The vulnerability was reported to IBM by David Lodge at Pen Test PArtners

Change History

24 Nov 2017: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSGSPN","label":"IBM Workload Scheduler"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Not Applicable","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"}],"Version":"8.6;9.1;9.2","Edition":"All Editions","Line of Business":{"code":"LOB45","label":"Automation"}}]

Tips

Security Bulletin: OpenSSL command line utility in IBM Workload Scheduler can run with elevated priviliges (CVE-2017-1716)