PT-2016-3796 · Ibm · Ibm Spss Statistics

Published 2016-01-01 · Updated 2016-12-07 · CVE-2015-7489

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM SPSS Statistics versions 22.0.0.2 before IF10 IBM SPSS Statistics versions 23.0.0.2 before IF7

Description The issue allows local users to gain privileges by modifying a Python script due to weak permissions set for these scripts. The weak permissions, specifically 'Everyone: Write', enable unauthorized access and modification of the scripts.

Recommendations For IBM SPSS Statistics version 22.0.0.2 before IF10, update to a version that includes IF10 or later to resolve the issue. For IBM SPSS Statistics version 23.0.0.2 before IF7, update to a version that includes IF7 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-7489

Affected Products

Ibm Spss Statistics

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21973502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7489 · Security Note
• http://securitytracker.com/id/1034546 · Note