High severity · published Jun 19, 2016
CVE-2016-0392
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as…
8.4
CVSS
0.5%
EPSS
No
On KEV
Description
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Elastic Storage Server · Ibm
2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +14 more · source: NVD
GP
General Parallel File System Storage Server · Ibm
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0392
packetstormsecurity.com
http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IV84206
www.securityfocus.com
http://www.securityfocus.com/archive/1/538620/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/91082
www.securitytracker.com
http://www.securitytracker.com/id/1036458
More from Elastic Storage Server
7.5
CVE-2020-5015
IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending…
6.5
CVE-2020-4383
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while configuring some of…
6.5
CVE-2020-4381
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific…
6.2
CVE-2017-1304
IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported…
5.5
CVE-2020-4756
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a…