PT-2015-2641 · Ibm · Ibm Infosphere Information Server

Published 2015-11-04 · Updated 2016-12-07 · CVE-2015-5021

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 11.3 through 11.5

Description The issue is related to insufficient access control to certain functions, allowing remote authenticated users to bypass intended job-execution restrictions or obtain sensitive information. This can enable an attacker to circumvent existing access restrictions and gain access to protected information.

Recommendations For IBM InfoSphere Information Server versions 11.3 through 11.5, consider restricting access to sensitive functions and data to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the privileges of remote authenticated DataStage users to prevent them from bypassing job-execution restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-12006

CVE-2015-5021

Affected Products

Ibm Infosphere Information Server

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg1JR54224 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21968195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5021 · Security Note
• https://bdu.fstec.ru/vul/2015-12006 · Security Note
• http://securitytracker.com/id/1034043 · Note