Security Bulletin: IBM Spectrum LSF is affected by a privilege escalation vulnerability

Summary

IBM Spectrum LSF has addressed the following vulnerability. Enhancing the eauth executable file to prevent the preloading of getuid to avoid the users changing their job user at job submission time.

Vulnerability Details

CVEID:CVE-2018-1724 **DESCRIPTION:*IBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to change their job user at job submission time due to improper file permission settings.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/147439&gt; for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected IBM Platform LSF

|

Affected Versions

—|—

IBM Spectrum LSF

|

10.1

IBM Spectrum LSF

|

9.1.1

IBM Spectrum LSF

|

9.1.2

IBM Spectrum LSF

|

9.1.3

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Remediation / First Fix

—|—|—|—

IBM Spectrum LSF

|

10.1

|

P102716

|

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/IBM+Spectrum+LSF&amp;release=All&amp;platform=All&amp;function=fixId&amp;fixids=lsf-10.1-build501633&amp;includeSupersedes=0

IBM Spectrum LSF

|

9.1.1

|

P102716

|

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/Platform+LSF&amp;release=All&amp;platform=All&amp;function=fixId&amp;fixids=lsf-9.1.1-build501933&amp;includeSupersedes=0

IBM Spectrum LSF

|

9.1.2

|

P102716

|

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/Platform+LSF&amp;release=All&amp;platform=All&amp;function=fixId&amp;fixids=lsf-9.1.2-build501919&amp;includeSupersedes=0

IBM Spectrum LSF

|

9.1.3

|

P102716

|

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/Platform+LSF&amp;release=All&amp;platform=All&amp;function=fixId&amp;fixids=lsf-9.1.3-build501909&amp;includeSupersedes=0

Workarounds and Mitigations

Workaround: Create eauth key in /etc/lsf.sudoers file on each host.