Security Bulletin: Privilege escalation and code injection vulnerabilities in IBM Spectrum Protect Plus application protection (CVE-2019-4383, CVE-2019-4357)

Summary IBM Spectrum Protect Plus application protection could allow a local attacker to gain elevated privileges or execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2019-4383 DESCRIPTION: When using Spectrum Protect Plus to protect Oracle or MongoDB databases, a redirected...

Security Bulletin: Speculative Store Bypass (SSB) vulnerability also known as SpectreNG or Variant 4 affects IBM Spectrum Protect Plus (CVE-2018-3639)

Summary IBM Spectrum Protect Plus may be affected by the Speculative Storage Bypass SSB vulnerability which is also known as SpetreNG or Variant 4. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU''s could allow a local attacker to obtain sensitive information, caused by...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0739, CVE-2018-0737, CVE-2018-0732)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on March 27, 2018, April 16, 2018, and June 12, 2018. OpenSSL, used by IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM PureApplication System and IBM PureApplication System supporting products

Summary Multiple Vulnerabilities in OpenSSL as reported by the OpenSSL project, and IBM PureApplication System supporting products affects IBM PureApplication System. IBM PureApplication System addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3731 DESCRIPTION: OpenSSL is...

Security Bulletin: Vulnerability in OpenSSL affects IBM PureApplication System (CVE-2017-3731)

Summary A potential denial of service vulnerability was reported by the OpenSSL project. IBM PureApplication System addressed the applicable CVE. Additionally this security bulletin addresses the IBM PureApplication System supporting products responses to CVE-2017-3730, CVE-2017-3731, CVE-2017-37...

Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony

Summary Multiple vulnerabilities exist in the Jackson databind, core, and annotations version used by IBM Spectrum Symphony 7.2.1, 7.2.0.2, and 7.1.2, and IBM Platform Symphony 7.1.1 and 7.1 Fix Pack 1. Interim fixes that provide instructions on upgrading Jackson databind, core, and annotations t...

Information disclosure

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...

Security Bulletin: Remote code execution vulnerability (CVE-2019-3778) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2019-3778. Vulnerability Details CVE-ID: CVE-2019-3778 Description: Spring Security OAuth could allow a remote attacker t...

Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2019-3880)

Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method that could allow a remote authenticated attacker to traverse a symbolic link on the system and write files outside the SMB share. Vulnerability Details This vulnerability only affects systems having SMB1 and...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum LSF Process Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Spectrum LSF Process Manager. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered...

IBM Spectrum Control Information Disclosure Vulnerability

IBM Spectrum Control formerly known as Tivoli Storage Productivity Center is a suite of storage resource management software from IBM in the United States. The software provides monitoring, automation and analysis for multiple storage systems. An information disclosure vulnerability exists in IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™Version 7 used by IBM Spectrum LSF Analytics. IBM Spectrum LSF Analytics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2699 DESCRIPTION: Oracle's JREs/JDKs on Windows ship with an old version of...

CVE-2019-4259

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

CVE-2019-4259

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

Security feature bypass

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

CVE-2019-4259

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale with CES stack enabled that could allow sensitive data to be included with service snaps. This data could be sent to IBM during service engagements (CVE-2019-4259)

Summary A security vulnerability has been identified in IBM Spectrum Scale with CES stack enabled that could allow sensitive data to be included with service snaps. This data could be sent to IBM during service engagements CVE-2019-4259 Vulnerability Details Deployments with protocol access metho...

CVE-2019-4071

IBM Security Bulletin for CVE-2019-4071 confirms a CSV injection/validation flaw in IBM Tivoli Storage Productivity Center (rebranded IBM Spectrum Control). Affected versions include IBM Tivoli Storage Productivity Center 5.2.0–5.2.7.1, IBM Spectrum Control 5.2.8–5.2.17.2, and IBM Spectrum Contro...

CVE-2019-4072

IBM Tivoli Storage Productivity Center IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17 allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time,...

Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale (CVE-2018-10237)

Summary There is a vulnerability in IBM WebSphere Application Server, used by IBM Spectrum Scale. This issue allow a remote attacker to cause a denial of service condition. Vulnerability Details IBM WebSphere Application Server is used to provide graphical user interface for managing Spectrum...