Summary

There is a potential directory traversal vulnerability in WebSphere Application Server (CVE-2018-1797). This is occurs when an Enterprise Bundle Archive (EBA) is installed into the Application Server that has a path external to the EBA.

Vulnerability Details

CVEID: CVE-2018-1797 DESCRIPTION: IBM WebSphere Application Server using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing “dot dot slash” sequences (…/), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as “Zip-Slip”.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149427&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

Affected Products and Versions

Tivoli Integrated Portal version 2.1.0 - 2.1.0.5

Tivoli Integrated Portal version 2.2.0.0 - 2.2.0.19

Remediation/Fixes

2.1.0 - 2.1.0.5

2.2.0 - 2.2.0.19

| embedded Websphere Application Server version 7.0.x |

Security Bulletin: Potential directory traversal vulnerability in WebSphere Application Server (CVE-2018-1797)

The Websphere security bulletin above provides a link to the required iFix to remediate the vulnerability. However, the iFix requires either eWAS 7.0.0.31 or higher installed.

TIP does not support upgrading Websphere fixpack independently. TIP 2.2.0.15 or TIP 2.2.0.17 or TIP 2.2.0.19 must be applied which will upgrade eWAS to 7.0.0.31 and above. Once TIP FP has been applied, the Websphere iFix can be applied as described in the Websphere bulletin.

Workarounds and Mitigations

Please refer to WAS iFix as described above