CVE-2014-3020

CVE-2014-3020 affects IBM embedded WebSphere Application Server (eWAS) 7.0 bundled with IBM Tivoli/Directory Server. An optional install script (install.sh) may grant write access to the installRoot directory, enabling local privilege escalation via a Trojan horse. IBM security bulletins describe...