Security Bulletin: Multiple security vulnerabilities have been identified in IBM® General Parallel File System shipped with IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System for Operational Analytics

Summary

IBM General Parallel File System is shipped as a component of IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System for Operational Analytics. Information about a security vulnerability affecting IBM General Parallel File System has been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2015-0197** **
DESCRIPTION: IBM General Parallel File System could allow a local attacker which only has a non-privileged account to execute programs with root privileges.

CVSS Base Score: 6.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101224 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0199** **
DESCRIPTION: IBM General Parallel File System allows attackers to cause kernel memory corruption by issuing specific ioctl calls to a character device provided by the mmfslinux kernel module and escalate privileges or cause a denial of service.

CVSS Base Score: 6.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101226 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0198** **
DESCRIPTION: IBM General Parallel File System may not properly authenticate network requests and could allow an attacker to execute programs remotely with root privileges.

CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101225 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM Smart Analytics System 7600
IBM Smart Analytics System 7700
IBM Smart Analytics System 7710
IBM PureData System for Operational Analytics V1.0 (A1791)
IBM PureData System for Operational Analytics V1.1 (A1801)

Remediation/Fixes

For each affected component in the table, download the recommended fix, and install using the link in the Installation instructions column.

For more information about IBM IDs, see the Help and FAQ.

IBM Smart Analytics System 7600, 7700 and 7710

Affected Component|Recommended Fix|Download Link|Installation Instructions
IBM General Parallel File System| Upgrade to GPFS V3.5.0.24| See installation instructions.| <http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062&gt;
IBM PureData System for Operational Analytics V1.0 (A1791) Affected Component|Recommended Fix|Download Link|Installation Instructions
IBM General Parallel File System| Install IBM PureData System for Operational Analytics Fix Pack V1.0.0.4 then upgrade to GPFS V4.1.0.8| GPFS 4.1.0.8 Link In IBM Fix Central| How to apply a GPFS fixpack in a PureData System for Operational Analytics Environment. IBM PureData System for Operational Analytics V1.1 (A1801) Affected Component|Recommended Fix|Download Link|Installation Instructions
IBM General Parallel File System| Upgrade to GPFS V4.1.0.8| GPFS 4.1.0.8 Link In IBM Fix Central| How to apply a GPFS fixpack in a PureData System for Operational Analytics Environment.

For assistance, contact IBM Support:

• In the United States and Canada dial 1-800-IBM-SERV
• View the support contacts for other countries outside of the United States.
• Electronically open a Service Request with IBM Support.