Security Bulletin: IBM InfoSphere Information Server may be vulnerable to attacks based on privilege escalation

Summary

A potential vulnerability based on privilege escalation was addressed by IBM InfoSphere Information Server.

Vulnerability Details

CVEID:CVE-2020-4347
**DESCRIPTION:**IBM InfoSphere Information Server could be subject to attacks based on privilege escalation due to inappropriate file permissions for files used by WebSphere Application Server Network Deployment.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178412 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

If your Information Server installation uses WebSphere Application Server Network Deployment (WAS ND), it is affected if the following apply:

• was initially installed using a umask weaker than 022
  Note that the install instructions indicate that umask 022 should be used.

-- or –

• is Information Server version 11.7.1.0 or versions 11.7.0.x, or such an installation was upgraded to a release after 11.7.1.0
  Note:
  1. Versions 11.5 and 11.3 are not impacted until they are upgraded to version 11.7.
  2. A new installation of version 11.7.1.1 (or later) is not impacted.

Remediation/Fixes

You should do the following steps (only needed once over the lifetime of the installation):

Stand-alone deployment
1. In your WAS ND location, change directory to the directory containing the java folder.
2. chmod -R 755 java

Cluster deployment
1. On the machine where your deployment manager is installed
a. change directory to the directory containing the java folder within your WAS ND installation
b. chmod -R 755 java

2. On a machine where a custom profile is installed
a. change directory to the directory containing the java folder within your WAS ND installation
b. chmod -R 755 java

3. Repeat step 2 for each custom profile, and horizontal machine that is a member of the cluster.

Workarounds and Mitigations

see Remediation/Fixes section.