Security Bulletin: Remote code execution vulnerability (CVE-2018-1260) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary

Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability (CVE-2018-1260).

Vulnerability Details

CVEID: CVE-2018-1260 DESCRIPTION: Pivotal Spring Security OAuth could allow a remote attacker to execute arbitrary code on the system. By sending a specially crafted authorization request to the authorization endpoint, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/143171&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Remediation/Fixes

The fixes can be downloaded from IBM Fix Central:

sym-7.2.0.2-build496164:

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/IBM+Spectrum+Symphony&release=All&platform=All&function=fixId&fixids=sym-7.2.0.2-build496164&includeSupersedes=0

sym-7.2.1-build496413:

http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/IBM+Spectrum+Symphony&release=All&platform=All&function=fixId&fixids=sym-7.2.1-build496413&includeSupersedes=0

Workarounds and Mitigations

None.