Insecure DLL loading in IBM Java SDK - CVE-2018-1890

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71638

Insecure DLL loading in IBM Java SDK - CVE-2018-1890

Published: January 30, 2023


Vulnerability identifier: #VU71638
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1890
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to elevate privilege on the system.

The vulnerability exists due to IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs. A local user can trigger the vulnerability to facilitate code injection and elevate privilege on the system.


Affected software

IBM Java SDK
IBM Cloud Transformation Advisor
IBM Tivoli System Automation Application Manager
Tivoli System Automation for Multiplatforms

How to mitigate CVE-2018-1890

Install updates from vendor's website.

IBM Cloud Transformation Advisor - update to 1.9.8
IBM Tivoli System Automation Application Manager - addressed in versions 4.1.0.1.0.11, 4.1.0.2.0.1
Tivoli System Automation for Multiplatforms - addressed in versions 4.1.0.3.0.8, 4.1.0.4.0.5

External References

Related Security Bulletins