CVE-2018-1890 - OpenCVE

IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Ibm	Sdk

Configuration 1 [-]

cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/107448	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152081	VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10873042	Patch Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10873332	Patch Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10874750	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: ibm

Published: 2019-03-01T00:00:00

Updated: 2019-03-22T12:06:04

Reserved: 2017-12-13T00:00:00

Link: CVE-2018-1890

JSON object: View

NVD Information

Status : Modified

Published: 2019-03-11T22:29:00.343

Modified: 2019-10-09T23:39:17.510

Link: CVE-2018-1890

JSON object: View

Redhat Information

No data.

CWE

CWE-427

{"containers": {"cna": {"affected": [{"product": "WebSphere Application Server Patterns", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0.0"}, {"status": "affected", "version": "1.0.0.7"}, {"status": "affected", "version": "2.2.0.0"}, {"status": "affected", "version": "2.2.5.3"}]}, {"product": "WebSphere Application Server", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "Liberty"}]}, {"product": "Runtimes for Java Technology", "vendor": "IBM", "versions": [{"status": "affected", "version": " "}]}], "datePublic": "2019-03-01T00:00:00", "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "LOW", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "CHANGED", "temporalScore": 4.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:L/AC:H/AV:L/C:L/I:L/PR:N/S:C/UI:N/E:U/RC:C/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Gain Privileges", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-22T12:06:04", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107448"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-03-01T00:00:00", "ID": "CVE-2018-1890", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WebSphere Application Server Patterns", "version": {"version_data": [{"version_value": "1.0.0.0"}, {"version_value": "1.0.0.7"}, {"version_value": "2.2.0.0"}, {"version_value": "2.2.5.3"}]}}, {"product_name": "WebSphere Application Server", "version": {"version_data": [{"version_value": "7.0"}, {"version_value": "8.0"}, {"version_value": "8.5"}, {"version_value": "9.0"}, {"version_value": "Liberty"}]}}, {"product_name": "Runtimes for Java Technology", "version": {"version_data": [{"version_value": " "}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}]}, "impact": {"cvssv3": {"BM": {"A": "L", "AC": "H", "AV": "L", "C": "L", "I": "L", "PR": "N", "S": "C", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Privileges"}]}]}, "references": {"reference_data": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873042", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873332", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10874750", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107448"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2018-1890", "datePublished": "2019-03-01T00:00:00", "dateReserved": "2017-12-13T00:00:00", "dateUpdated": "2019-03-22T12:06:04", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*", "matchCriteriaId": "6DEFC54D-3C43-499D-8F5E-75A02E5A1DF2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}, {"lang": "es", "value": "IBM SDK, Java Technology Edition, en su versi\u00f3n 8 en la plataforma AIX, utiliza RPATHS absolutas, lo que podr\u00eda facilitar una inyecci\u00f3n de c\u00f3digo y un escalado de privilegios por usuarios locales. IBM X-Force ID: 152081."}], "id": "CVE-2018-1890", "lastModified": "2019-10-09T23:39:17.510", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.4, "impactScore": 3.7, "source": "psirt@us.ibm.com", "type": "Secondary"}]}, "published": "2019-03-11T22:29:00.343", "references": [{"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107448"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}