Security Bulletin: A vulnerability in the instance runAsUser function was found in IBM InfoSphere Streams (CVE-2016-2867)

Summary

There is a potential vulnerability in IBM InfoSphere Streams when the instance runAsUser property is set. IBM InfoSphere Streams has addressed this vulnerability.

Vulnerability Details

CVEID: CVE-2016-2867**
DESCRIPTION:** In certain supported configurations of IBM InfoSphere Streams, setting the instance runAsUser property can result in operator code using the group id of the root user instead of the group id of the runAsUser for checking permissions.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112763 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

• IBM InfoSphere Streams Version 4.0.1.1 and earlier
• IBM Streams Version 4.1.1.0 and earlier

Remediation/Fixes

NOTE: Fix Packs are available on IBM Fix Central.

• Version 4.1.1:
  • Apply 4.1.1 Fix Pack 1 (4.1.1.1) or higher.
• Version 4.0.1:
  • Apply 4.0.1 Fix Pack 2 (4.0.1.2) or higher.

Workarounds and Mitigations

None