Additional Information About CVE-2019-4716

On February 11th the following Security Bulletin was released: https://www.ibm.com/support/pages/node/1127781

This article provides important details about CVE-2019-4716. This vulnerability impacts the TM1 database component from IBM Planning Analytics Local and IBM Planning Analytics on Cloud versions 2.0.0 to 2.0.8.

This security vulnerability has been addressed in the IBM Planning Analytics 2.0.9 release. The vulnerability impacts the C API that is used by Architect, Perspectives and other TM1 client applications. The REST/ODATA API used by Planning Analytics Workspace and Planning Analytics for Microsoft Excel is not susceptible to this vulnerability.

This vulnerability may allow an unauthorized user, access to Admin role in TM1 database. With this permission, the perpetrator has full access to all metadata and data in the TM1 database. The perpetrator can create and execute Turbo Integrator processes, including the use of ExecuteCommand Ti function that allows commands to be run on the host operating system with the same privileges as the using the account running the TM1 database process.

Within the IBM Planning Analytics on Cloud environment it is not possible to leverage this vulnerability without access to the rich client tier system that runs TM1 Architect, TM1 Perspectives, and Performance Modeler.

Within IBM Planning Analytics Local this vulnerability can only be used to target a TM1 database where the perpetrator has access to the TM1 CAPI port. This port number is determined by the PortNumber parameter in the tm1s.cfg file.

IBM recommends that Planning Analytics Local customers update to IBM Planning Analytics 2.0.9 to address this vulnerability. Interim Fixes can be made available for Planning Analytics 2.0.6 to 2.0.8. IBM Planning Analytics customers using 2.0.6 and lower are recommended to upgrade to 2.0.6 or higher. If an Interim Fix is required, please open a ticket with IBM Support.

[{“Business Unit”:{“code”:“BU059”,“label”:“IBM Software w/o TPS”},“Product”:{“code”:“SSCTEW”,“label”:“IBM Planning Analytics Local”},“Component”:“TM1 Server”,“Platform”:[{“code”:“PF016”,“label”:“Linux”},{“code”:“PF033”,“label”:“Windows”}],“Version”:“All Versions”,“Edition”:“”,“Line of Business”:{“code”:“LOB10”,“label”:“Data and AI”}}]