Security Bulletin: OpenSSL command line utility in IBM Workload Scheduler can run with elevated priviliges (CVE-2017-1716)

Summary

OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges

Vulnerability Details

OpenSSL command line utility in IBM Workload Scheduler, installed in <TWS installation directory>/TWS/bin/openssl, is installed with SUID permssion, as showed below
-r-s–s–x 1 twsuser twsuser 2369776 Nov 22 11:01 openssl
For this reason the utility can run with elevated priviliges and users that are not typically allowed to see TWS configuration files can obtain read and write access to them.

CVEID:CVE-2017-1716**
DESCRIPTION:** IBM Tivoli Workload Scheduler could disclose sensitive information to a local attacker due to improper permission settings.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134638 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier

Remediation/Fixes

APAR IJ02011 has been opened to address the openssl utility vulnerability for IBM Tivoli Workload Scheduler.

The apar will be fixed in the following fixpacks

8.6.0-TIV-TWS-FP0005
9.1.0-TIV-TWS-FP0003
9.2.0-TIV-TWS-FP0003

For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.

Workarounds and Mitigations

To workaround this issue it is enough to change the permissions for openssl utility:

chmod 755 <TWS installation directory>/TWS/bin/openssl