Security Bulletin: WebSphere Application Server shipped with Tivoli Integrated Portal (TIP) may have insecure file permissions (CVE-2017-1382)

Summary

WebSphere Application Server may have insecure file permissions after custom startup scripts are run. The custom startup script will not pull the umask from the server.xml. This may cause some log files to have different permissions then expected.

Vulnerability Details

CVEID: CVE-2017-1382** DESCRIPTION:** IBM WebSphere Application Server might create files using the default permissions instead of the customized permissions when custom startup scripts are used. A local attacker could exploit this to gain access to files with an unknown impact.
CVSS Base Score: 5.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/127153 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Tivoli Integrated Portal version 2.1.0 - 2.1.0.5

Tivoli Integrated Portal version 2.2.0.0 - 2.2.0.19

Remediation/Fixes

Principal Product and Version(s)

| Affected Supporting Product and Version| Affected Supporting Product Security Bulletin
—|—|—
Tivoli Integrated Portal version

2.1.0 - 2.1.0.5

2.2.0 - 2.2.0.19

| embedded Websphere Application Server version 7.0.x| WebSphere Application Server may have insecure file permissions (CVE-2017-1382)

The Websphere security bulletin above provides a link to the required iFix to remediate the vulnerability. However, the iFix requires either eWAS 7.0.0.31 or higher installed.

TIP does not support upgrading Websphere fixpack independently. TIP 2.2.0.15 or TIP 2.2.0.17 or TIP 2.2.0.19 must be applied which will upgrade eWAS to 7.0.0.31 and above. Once TIP FP has been applied, the Websphere iFix can be applied as described in the Websphere bulletin.

Workarounds and Mitigations

Please refer to WAS iFix as described above