IBM Security Bulletin: The GPFS pattern provided with IBM PureApplication System is affected by a security vulnerability. (CVE-2016-0263)

A security vulnerability has been identified in the current levels of IBM Spectrum Scale V4.2, V4.1 and IBM General Parallel File System V3.5, that could allow a local user, under special circumstances, to escalate their privileges or cause a denial of service when the mmapplypolicy command is issued with certain options and syntax. IBM PureApplication System provides a GPFS pattern and addressed the applicable CVE.

CVE(s): CVE-2016-0263


Affected product(s) and affected version(s):

· IBM PureApplication System V2.0 (GPFS Pattern type 1.2.0.0, 1.2.0.1, and 1.2.0.2) using IBM GPFS V3.5.0.19
· IBM PureApplication System V2.1.0.1 (GPFS Pattern type 1.2.1.0) using IBM GPFS V4.1.0.5
· IBM PureApplication System V2.1.0.2 (GPFS Pattern type 1.2.2.0) using IBM GPFS V4.1.0.7
· IBM PureApplication System V2.1.1.0 (GPFS Pattern type 1.2.3.0) using IBM GPFS V4.1.0.7
· IBM PureApplication System V2.1.2.0 (GPFS Pattern type 1.2.4.0) using IBM GPFS V4.1.1.2
· IBM PureApplication System V2.2.0 (GPFS Pattern type 1.2.5.0) using IBM GPFS V4.1.1.3

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/23T5w5E
X-Force Database: http://ift.tt/1WyX8tp


from IBM Product Security Incident Response Team http://ift.tt/23T5Dhx