A vulnerability, which was classified as critical, has been found in IBM Spectrum LSF 9.1.1/9.1.2/9.1.3/10.1. This issue affects an unknown code of the component File Permission. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

IBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to obtain highly sensitive information or escalate their privileges to root due to improper file permission settings. IBM X-Force ID: 147439.

The bug was discovered 10/07/2018. The weakness was published 10/11/2018 (Website). It is possible to read the advisory at exchange.xforce.ibmcloud.com. The identification of this vulnerability is CVE-2018-1724 since 12/12/2017. Attacking locally is a requirement. A simple authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/25/2023). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• IBM

Name

• Spectrum LSF

Version

• 9.1.1
• 9.1.2
• 9.1.3
• 10.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion