Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-2098 CVE-2016-2097)

Summary

Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9 and IBM BigFix Inventory v9.

Vulnerability Details

CVEID: CVE-2016-2098**
DESCRIPTION:** Ruby on Rails could allow a remote attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input by the render method. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary ruby code on the system with elevated privileges.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111173 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-2097**
DESCRIPTION:** Ruby on Rails could allow a remote attacker to obtain sensitive information, caused by improper validation of user-supplied input by the render method. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to view files located outside of the target application’s view directory.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111174 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM License Metric Tool v9

IBM BigFix Inventory v9

Remediation/Fixes

Upgrade to version v9.2.4.0.

Use the following procedure:

• In IBM Endpoint Manager console, expand IBM BigFix InventoryorIBM License Reporting (ILMT) node underSites node in the tree panel.
• Click Fixlets and Tasks node.Fixlets and Tasks panel will be displayed on the right.
• In the Fixlets and Tasks panel locate _Upgrade to the newest version of IBM BigFix Inventory 9.x _or Upgrade to the newest version IBM License Metric Tool 9.x fixlet and run it against the computer that hosts your server.

Note: In an airgapped environment, you have to run BESAirgapTool and BESDownloadCacher first in order to update your site.

Workarounds and Mitigations

None