Security Bulletin: IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments allow Triple DES (3DES) ciphers to be used (CVE-2018-1785)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager and IBM Spectrum Protect for Virtual Environments allow Triple DES 3DES ciphers to be used. This can result in the use of weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1785 DESCRIPTION: IBM Tivoli...

Security Bulletin: IBM Spectrum Scale for IBM Elastic Storage Server is affected by the use of Local Read Only Cache (LROC) which may result in directory corruption and undetected data corruption in regular files.

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale where after cached data is moved from memory to the LROC device, any changes to that data should trigger invalidation of the data stored in LROC. Due to a problem with invalidation logic, it is possible for th...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2016-0705, CVE-2017-3732, CVE-2017-3736, CVE-2018-1656, CVE-2018-12539)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center and IBM Spectrum Protect formerly Tivoli Storage Manager Client Management Service. These issues were disclosed as part of the IBM Ja...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect Operations Center (CVE-2018-1553, CVE-2018-1683, CVE-2018-8039)

Summary Multiple vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitiv...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect the IBM Spectrum Protect Server (CVE-2018-2579, CVE-2018-2603, CVE-2018-2783)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by the IBM Spectrum Protect Server. These issues were disclosed as part of the IBM Java SDK updates in January 2018 and April 2018. UPDATED 1/16/2019: Changed "First Fixing VRM Level" in Remediation/Fixes table for...

Security Bulletin: Password disclosure via trace log in IBM Spectrum Protect (formerly Tivoli Storage Manager) Server (CVE-2018-1788)

Summary When tracing is enabled, some passwords may be displayed in the IBM Spectrum Protect formerly Tivoli Storage Manager Server trace file. UPDATED 1/16/2019: Changed "First Fixing VRM Level" in Remediation/Fixes table for 8.1 from 8.1.6 to 8.1.6.100 Vulnerability Details CVEID: CVE-2018-1788...

IBM Spectrum Scale Detection (HTTP)

Detection of IBM Spectrum Scale. The script sends a connection request to the server and attempts to detect IBM Spectrum Scale and to extract its version. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2018-1993

IBM Spectrum Scale GPFS 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache LROC is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440...

CVE-2018-1993

IBM Spectrum Scale GPFS 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache LROC is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440...

Default configuration

IBM Spectrum Scale GPFS 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache LROC is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440...

PT-2019-9946

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale GPFS versions 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 Description The issue may cause read operations on a file to return data from a different file when Local Read Only Cache LROC is enabled. Recommendations For IBM...

CVE-2018-1993: Exposure of Sensitive Information to an Unauthorized Actor

IBM Spectrum Scale GPFS 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache LROC is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where the use of Local Read Only Cache (LROC) may result in directory corruption and undetected data corruption in regular files.

Summary After cached data is moved from memory to the LROC device, any changes to that data should trigger invalidation of the data stored in LROC. Due to a problem with invalidation logic, it is possible for invalidation of this LROC data to be skipped. This could lead to stale or incorrect data...

IBM Spectrum Protect Client 7.1.x < 7.1.8.4 / 8.1.x < 8.1.6.1 Denial of Service Vulnerability (CVE-2018-1786)

IBM Spectrum Protect, formerly known as Tivoli Storage Manager, installed on the remote host is version 7.1.x 7.1.8.4 or 8.1.x 8.1.6.1. It is, therefore, affected by a denial of service DoS vulnerability due to the incorrect accumulation of TCP/IP sockets in a CLOSEWAIT state. An unauthenticated,...

Security Bulletin: Privilege escalation in SUID of egosh binary impacts IBM Platform Symphony and IBM Spectrum Symphony

Summary When you start a host in an IBM Platform Symphony cluster with the "egosh ego start" command, the egosh binary is assigned the SUID of the root user and started as root. For users who don’t require root permission, this root access is a potential security issue. This enhancement introduce...

Security Bulletin: There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Transparent Cloud Tiering. Transparent Cloud Tiering has addressed the applicable CVEs.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Transparent Cloud Tiering. Transparent Cloud Tiering has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment''s Diagnostic Tooling...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum LSF Process Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Spectrum LSF Process Manager. IBM Spectrum LSF Process Manager has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Spectrum LSF Analytics. IBM Spectrum LSF Analytics has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you...

Security Bulletin: The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1782)

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale which could allow a local, unprivileged user to cause a kernel panic on a node running GPFS by accessing a file that is stored on a GPFS file system with mmap, or by executing a crafted file stored on a GPFS...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale packaged in IBM Elastic Storage Server (CVE-2018-12539)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Elastic Storage Server. This issue was disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to...