PT-2015-2601 · Ibm · Ibm Spectrum Scale+1

Published 2015-10-26 · Updated 2016-12-06 · CVE-2015-4974

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM General Parallel File System (GPFS) versions 3.5.x through 3.5.0.27 IBM General Parallel File System (GPFS) versions 4.1.x through 4.1.1.2 IBM Spectrum Scale versions 4.1.1.x through 4.1.1.2

Description The issue is related to the lack of input data sanitization in IBM Spectrum Scale and General Parallel File System, which can be exploited by a local attacker to gain root privileges when executing commands.

Recommendations For IBM General Parallel File System (GPFS) versions 3.5.x through 3.5.0.27, update to version 3.5.0.27 or later. For IBM General Parallel File System (GPFS) versions 4.1.x through 4.1.1.2, update to version 4.1.1.2 or later. For IBM Spectrum Scale versions 4.1.1.x through 4.1.1.2, update to version 4.1.1.2 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2015-11966

CVE-2015-4974

Affected Products

Ibm General Parallel File System

Ibm Spectrum Scale

References · 6

• https://bdu.fstec.ru/vul/2015-11966 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4974 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005366 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21972152 · Note
• http://securityfocus.com/bid/77025 · Note
• http://securitytracker.com/id/1035094 · Note