Security Bulletin: Vulnerabilities in Rational ClearCase with potential for privilege escalation (CVE-2013-5415, CVE-2013-5416)

Summary

Buffer overflow and privilege escalation vulnerabilities exist in IBM Rational ClearCase.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

****CVE ID:CVE-2013-5415

Description:
Undisclosed buffer overflow and privilege escalation vulnerabilities in IBM Rational ClearCase could be exploited by a local user to gain elevated privilege of another user or the system account.

CVSS Base Score: 6.9 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/87477&gt; for the current score *CVSS Environmental Score:**Undefined **CVSS Vector: **(AV:L/AC:M/Au:N/C:C/I:C/A:C)

**CVE ID:******CVE-2013-5416

Description:
Undisclosed buffer overflow and privilege escalation vulnerabilities in IBM Rational ClearCase could be exploited by a local user to gain elevated privilege of another user or the system account.

CVSS Base Score: 6.9 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/87478&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM Rational ClearCase and IBM Rational ClearCase MultiSite, releases 7.1.1.x, 7.1.2 through 7.1.2.12, 8.0.0.0 through 8.0.0.8, and 8.0.1.0 through 8.0.1.1. All earlier out-of-support release streams are also affected.

Remediation/Fixes

Releases of IBM Rational ClearCase with a fix pack including the security fixes:

• Clients using 8.0.1, upgrade to Rational ClearCase Fix Pack 2 (8.0.1.2) for 8.0.1
• Clients using 8.0.0, upgrade to Rational ClearCase Fix Pack 9 (8.0.0.9) for 8.0
• Clients using 7.1.0, 7.1.1, or 7.1.2, upgrade to Rational ClearCase Fix Pack 13 (7.1.2.13) for 7.1.2. Note: 7.1.2.13 inter-operates with all 7.1.x.x systems, and can be installed in the same way as any 7.1.x.x fixpack.

Workarounds and Mitigations

None