Vulnerability-Lookup

CNVD-2018-17159

Vulnerability from cnvd - Published: 2018-08-31

Title

IBM Spectrum Scale GSKit提权漏洞

Description

IBM Spectrum Scale是美国IBM公司的一套基于IBM GPFS（专为PB级存储管理而优化的企业文件管理系统）的可扩展的数据及文件管理解决方案。该方案支持帮助客户减少存储成本，同时提高云、大数据和分析环境中的安全性和管理效率等。GSKit是其中的一套IBM产品的安全管理工具。 IBM Spectrum Scale中的GSKit存在安全漏洞。本地攻击者可利用该漏洞控制Spectrum Scale守护进程，访问并修改Spectrum Scale文件系统中的文件并可能获取管理员权限。

Severity

中

Patch Name

IBM Spectrum Scale GSKit提权漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012049

Reference

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012049

Impacted products

Name
['IBM Spectrum Scale 4.1.1', 'IBM Spectrum Scale 4.2.0', 'IBM Spectrum Scale 4.2.1', 'IBM Spectrum Scale 4.2.3', 'IBM Spectrum Scale 5.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1431",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1431"
    }
  },
  "description": "IBM Spectrum Scale\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eIBM GPFS\uff08\u4e13\u4e3aPB\u7ea7\u5b58\u50a8\u7ba1\u7406\u800c\u4f18\u5316\u7684\u4f01\u4e1a\u6587\u4ef6\u7ba1\u7406\u7cfb\u7edf\uff09\u7684\u53ef\u6269\u5c55\u7684\u6570\u636e\u53ca\u6587\u4ef6\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u5e2e\u52a9\u5ba2\u6237\u51cf\u5c11\u5b58\u50a8\u6210\u672c\uff0c\u540c\u65f6\u63d0\u9ad8\u4e91\u3001\u5927\u6570\u636e\u548c\u5206\u6790\u73af\u5883\u4e2d\u7684\u5b89\u5168\u6027\u548c\u7ba1\u7406\u6548\u7387\u7b49\u3002GSKit\u662f\u5176\u4e2d\u7684\u4e00\u5957IBM\u4ea7\u54c1\u7684\u5b89\u5168\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nIBM Spectrum Scale\u4e2d\u7684GSKit\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236Spectrum Scale\u5b88\u62a4\u8fdb\u7a0b\uff0c\u8bbf\u95ee\u5e76\u4fee\u6539Spectrum Scale\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684\u6587\u4ef6\u5e76\u53ef\u80fd\u83b7\u53d6\u7ba1\u7406\u5458\u6743\u9650\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=ssg1S1012049",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-17159",
  "openTime": "2018-08-31",
  "patchDescription": "IBM Spectrum Scale\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eIBM GPFS\uff08\u4e13\u4e3aPB\u7ea7\u5b58\u50a8\u7ba1\u7406\u800c\u4f18\u5316\u7684\u4f01\u4e1a\u6587\u4ef6\u7ba1\u7406\u7cfb\u7edf\uff09\u7684\u53ef\u6269\u5c55\u7684\u6570\u636e\u53ca\u6587\u4ef6\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u5e2e\u52a9\u5ba2\u6237\u51cf\u5c11\u5b58\u50a8\u6210\u672c\uff0c\u540c\u65f6\u63d0\u9ad8\u4e91\u3001\u5927\u6570\u636e\u548c\u5206\u6790\u73af\u5883\u4e2d\u7684\u5b89\u5168\u6027\u548c\u7ba1\u7406\u6548\u7387\u7b49\u3002GSKit\u662f\u5176\u4e2d\u7684\u4e00\u5957IBM\u4ea7\u54c1\u7684\u5b89\u5168\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nIBM Spectrum Scale\u4e2d\u7684GSKit\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236Spectrum Scale\u5b88\u62a4\u8fdb\u7a0b\uff0c\u8bbf\u95ee\u5e76\u4fee\u6539Spectrum Scale\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684\u6587\u4ef6\u5e76\u53ef\u80fd\u83b7\u53d6\u7ba1\u7406\u5458\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Spectrum Scale GSKit\u63d0\u6743\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Spectrum Scale 4.1.1",
      "IBM Spectrum Scale 4.2.0",
      "IBM Spectrum Scale 4.2.1",
      "IBM Spectrum Scale 4.2.3",
      "IBM Spectrum Scale 5.0.0"
    ]
  },
  "referenceLink": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012049",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-19",
  "title": "IBM Spectrum Scale GSKit\u63d0\u6743\u6f0f\u6d1e"
}

CVE-2018-1431 (GCVE-0-2018-1431)

Vulnerability from cvelistv5 – Published: 2018-06-13 14:00 – Updated: 2024-09-17 00:26

Summary

A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node. IBM X-Force ID: 139240.

Severity ?

7.4 (High)


                        
                          CVSS:3.0/A:H/AC:H/AV:L/C:H/I:H/PR:N/S:U/UI:N/E:U/RC:C/RL:O

CWE

Gain Privileges

Assigner

ibm

References

URL

Tags

	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://www.securityfocus.com/bid/105546	vdb-entryx_refsource_BID
	http://www.ibm.com/support/docview.wss?uid=ssg1S1012049	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	IBM	Spectrum Scale	Affected: 4.1.1 Affected: 4.2.0 Affected: 4.2.1 Affected: 4.2.2 Affected: 4.2.3 Affected: 5.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:59:39.022Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ibm-spectrum-cve20181431-priv-escalation(139240)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139240"
          },
          {
            "name": "105546",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105546"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1012049"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spectrum Scale",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.1"
            },
            {
              "status": "affected",
              "version": "4.2.0"
            },
            {
              "status": "affected",
              "version": "4.2.1"
            },
            {
              "status": "affected",
              "version": "4.2.2"
            },
            {
              "status": "affected",
              "version": "4.2.3"
            },
            {
              "status": "affected",
              "version": "5.0.0"
            }
          ]
        }
      ],
      "datePublic": "2018-06-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node. IBM X-Force ID: 139240."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/A:H/AC:H/AV:L/C:H/I:H/PR:N/S:U/UI:N/E:U/RC:C/RL:O",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Gain Privileges",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T09:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "ibm-spectrum-cve20181431-priv-escalation(139240)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139240"
        },
        {
          "name": "105546",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105546"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1012049"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2018-06-11T00:00:00",
          "ID": "CVE-2018-1431",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spectrum Scale",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.1.1"
                          },
                          {
                            "version_value": "4.2.0"
                          },
                          {
                            "version_value": "4.2.1"
                          },
                          {
                            "version_value": "4.2.2"
                          },
                          {
                            "version_value": "4.2.3"
                          },
                          {
                            "version_value": "5.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node. IBM X-Force ID: 139240."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "H",
              "AC": "H",
              "AV": "L",
              "C": "H",
              "I": "H",
              "PR": "N",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Gain Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ibm-spectrum-cve20181431-priv-escalation(139240)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139240"
            },
            {
              "name": "105546",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105546"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=ssg1S1012049",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1012049"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2018-1431",
    "datePublished": "2018-06-13T14:00:00Z",
    "dateReserved": "2017-12-13T00:00:00",
    "dateUpdated": "2024-09-17T00:26:35.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-17159

CVE-2018-1431 (GCVE-0-2018-1431)

Tags

Sightings

Nomenclature