Permissions, Privileges, and Access Controls in OpenJ9 - CVE-2019-11771

Vulnerability identifier: #VU77345

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11771

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to AIX builds of Eclipse OpenJ9 contain unused RPATHs. A local user can trigger the vulnerability to bypass security restrictions and escalate privileges on the system.

OpenJ9
IBM Cloud Transformation Advisor
IBM Tivoli System Automation Application Manager
Tivoli System Automation for Multiplatforms

Install updates from vendor's website.

OpenJ9 - update to 0.15.0
IBM Cloud Transformation Advisor - update to 2.0.2
IBM Tivoli System Automation Application Manager - addressed in versions 4.1.0.1.0.13, 4.1.0.2.0.3
Tivoli System Automation for Multiplatforms - addressed in versions 4.1.0.3.0.10, 4.1.0.4.0.1, 4.1.0.4.0.7

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=548055

• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Tivoli System Automation for Multiplatforms
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager