PT-2021-5664 · Ibm · Ibm Tivoli Workload Scheduler

Lukasz Plonka + 1 · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-20349

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Tivoli Workload Scheduler versions 9.4 through 9.5

Description The issue is caused by improper bounds checking, leading to a stack-based buffer overflow. A local attacker could exploit this to gain lower level privileges, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For IBM Tivoli Workload Scheduler versions 9.4 and 9.5, consider applying security patches or updates to fix the improper bounds checking issue, which is causing the stack-based buffer overflow. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00103

CVE-2021-20349

Affected Products

Ibm Tivoli Workload Scheduler

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-20349 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/194599 · Vendor Advisory
• https://ibm.com/support/pages/node/6479347 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00103 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20349 · Vendor Advisory
• https://t.me/cibsecurity/27021 · Telegram Post
• https://t.me/cvenotify/19520 · Telegram Post
• https://ibm.com/blogs/psirt/security-bulletin-stack-overflow-via-tis_codeset-environment-variable-in-ibm-workload-scheduler · Note