IBM Support

Security Bulletin: IBM InfoSphere Information Server containers are vulnerable to privilege escalation

Security Bulletin


Summary

A privilege escalation vulnerability was addressed in IBM InfoSphere Information Server.

Vulnerability Details

CVEID: CVE-2019-4185
DESCRIPTION: IBM InfoSphere Information Server containers are vulnerable to privilege escalation due to an insecurely configured component.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/158975 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

The following products, running on all supported platforms, are affected:
        IBM InfoSphere Information Server: version 11.7.1
        IBM InfoSphere Information Server on Cloud: version 11.7.1


Remediation/Fixes

None

Workarounds and Mitigations

Perform the following steps to secure your environment:

1. List your kube-system namespace
     > kubectl get deployments -n kube-system
 

image-20190425180554-1

2. List the pods in your kube-system namespace
      > kubectl get deployments -n kube-system


image-20190425180646-2

3. Delete the tiller pod
     >  kubectl delete deployment tiller-deploy --namespace=kube-system

4. Verify that the tiller pod was deleted by examining the output of command
     > kubectl get deployments -n kube-system

    Verify that helm is working by executing the following command:
     > helm list

    The output should contain the list of deployed services.
    However, if the following error message is displayed:
         Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

         Execute the following command:
         > kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

        After 10 to 20 seconds, again check the output of "helm list" as indicated above.


NOTE:
After making the above changes, if at a later point in time you need to install a patch, you must deploy the tiller pod before installing the patch. Use the following steps:

1. Deploy tiller
     > /usr/local/bin/helm init

2. Verify that the tiller POD is created by executing the command
     >  kubectl get deployments -n kube-system

     You should see tiller-deploy listed in the output.

3. Install the patch

4. Repeat the steps listed above to again secure your environment.

Get Notified about Future Security Bulletins

Reference

Complete CVSS v3 Guide
On-line Calculator v3

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

06 May 2019: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document information

More support for: InfoSphere Information Server

Software version: 11.7.1

Operating system(s): AIX, Linux, Windows

Reference #: 0882626

Modified date: 06 May 2019