Security Bulletin: IBM Spectrum Scale Object Protocols functionality is affected by security vulnerabilities in OpenStack (CVE-2015-1852 and CVE-2015-7546)

Summary IBM Spectrum Scale Object Protocols functionality is affected by security vulnerabilities in OpenStack that could allow: - a man-in-the-middle attack, caused by an error in the api-paste.ini configuration file. A remote attacker could exploit this vulnerability using a specially-crafted...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2016-2126, 2016-2125)

Summary Samba vulnerabilities affect IBM Spectrum Scale SMB protocol access method which could allow: - a remote authenticated attacker to gain elevated privileges on the system, caused by forwarding a Ticket Granting Ticket TGT to other service when using Kerberos authentication. An attacker...

Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2017-2619)

Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method which could allow a remote authenticated attacker to launch a symlink attack, caused by a race condition. An attacker could exploit this vulnerability using SMB1 unix extensions or NFS to create a symbolic link fr...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Scale

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Spectrum Scale. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5547 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2017-12163, CVE-2017-12151, CVE-2017-12150)

Summary Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method that: - could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak over SMB1 CVE-2017-12163 - could provide weaker than expected security, caused by the failure to...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements (CVE-2017-1654)

Summary A vulnerability has been identified in IBM Spectrum Scale that could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements CVE-2017-1654. Vulnerability Details CVEID: CVE-2017-1654 DESCRIPTION: IBM Spectrum...

Security Bulletin: Vulnerabilities in GSKit affect IBM Spectrum Scale (CVE-2018-1431, CVE-2017-3736, CVE-2017-3732, CVE-2016-0705 )

Summary Vulnerabilities in GSKit affect IBM Spectrum Scale where: - a local attacker could obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node CVE-2018-1431 - OpenSSL could allow...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2017-14746, CVE-2017-15275)

Summary Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method that: - could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free memory error CVE-2017-14746 - could allow a remote attacker to obtain sensitive information, caused by a...

CVE-2018-1595

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale

Summary There is a vulnerability in IBM SDK Java Technology Edition, Version 8 used by IBM Spectrum Scale. This issue was disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to...

Security Bulletin: RCE vulnerability (CVE-2018-1595) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary A security vulnerability related to Remote Command Execution RCE, caused by dynamic JSP file builds, has been identified in IBM Platform Symphony 6.1.1, 7.1 Fix Pack 1, 7.1.1 and IBM Spectrum Symphony 7.1.2, 7.2.0.2. Vulnerability Details CVEID: CVE-2018-1595 DESCRIPTION: IBM Spectrum...

Security Bulletin: The Elastic Storage Server are affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1512)

Summary The Elastic Storage Server are affected by a vulnerability in IBM Spectrum Scale with CES stack enabled that could allow sensitive data to be included with service snaps. This data could be sent to IBM during service engagements CVE-2018-1512 Vulnerability Details CVEID: CVE-2018-1512...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Spectrum LSF Analytics. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with...

Security Bulletin: The Elastic Storage Server and the GPFS Storage Server are affected by a vulnerability in IBM Spectrum Scale

Summary The Elastic Storage Server and the GPFS Storage Server are affected by a multiple GSKit vulnerability in IBM Spectrum Scale. Vulnerability Details CVEID: CVE-2018-1431 DESCRIPTION: A vulnerability in GSKit affects IBM Spectrum Scale that could allow a local attacker to obtain control of t...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for Hyper-V

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments: Data Protection for Hyper-V. These issues were disclosed as part of the IBM Java SDK updates in October 2017 and January 2018...

IBM Spectrum Scale GSKit Privilege Vulnerability

IBM Spectrum Scale is a suite of scalable data and file management solutions from IBM in the United States based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The solution supports helping customers reduce storage costs while improving security...

Security Bulletin: Vertical authorization bypass vulnerability (CVE-2018-1613) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary The vertical authorization bypass vulnerability affects the Symping utility in IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2. Vulnerability Details CVEID: CVE-2018-1613 DESCRIPTION: IBM Platform Symphony and IBM Spectrum Symphony could allow a...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Spectrum LSF Analytics. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with...

Security Bulletin: Public disclosed vulnerability from Apache Commons affects IBM Spectrum LSF Explorer.

Summary Public disclosed vulnerability CVE-2018-1324 from Apache Commons affects IBM Spectrum LSF Explorer. Vulnerability Details CVE Descriptions CVEID: CVE-2018-1324 DESCRIPTION: A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2017-15698, CVE-2017-15706, CVE-2018-1323, CVE-2018-1305, CVE-2018-1304)

Summary This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.88 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.31 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address a security vulnerability in Tomcat CVE-2017-15698, CVE-2017-15706, CVE-2018-1323...