Security Bulletin
Summary
OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges
Vulnerability Details
OpenSSL command line utility in IBM Workload Scheduler, installed in <TWS installation directory>/TWS/bin/openssl, is installed with SUID permssion, as showed below
-r-s--s--x 1 twsuser twsuser 2369776 Nov 22 11:01 openssl
For this reason the utility can run with elevated priviliges and users that are not typically allowed to see TWS configuration files can obtain read and write access to them.
CVEID: CVE-2017-1716
DESCRIPTION: IBM Tivoli Workload Scheduler could disclose sensitive information to a local attacker due to improper permission settings.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier
Remediation/Fixes
APAR IJ02011 has been opened to address the openssl utility vulnerability for IBM Tivoli Workload Scheduler.
The apar will be fixed in the following fixpacks
8.6.0-TIV-TWS-FP0005
9.1.0-TIV-TWS-FP0003
9.2.0-TIV-TWS-FP0003
For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.
Workarounds and Mitigations
To workaround this issue it is enough to change the permissions for openssl utility:
chmod 755 <TWS installation directory>/TWS/bin/openssl
Get Notified about Future Security Bulletins
References
Acknowledgement
The vulnerability was reported to IBM by David Lodge at Pen Test PArtners
Change History
24 Nov 2017: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg22010947