CA Common Services CAIRIM on z/OS LMP SVC vulnerability

Date Discovered: 2006. május 2.
Date Published: 2006. május 3.
Last Updated: 2006. május 4.

Threat Assessment
Overall Risk: Medium
Impact:          High
Popularity:    Medium
Simplicity:    Very Low

Vulnerability Description
Vulnerability ID:         34013
Discovered By:           IBM Global Services
Exploitable Locally:   Yes
Exploitable Remotely: No
Impact:                        Attackers can gain escalated privileges.
Root Cause:                Software Vulnerability

CA Common Services CAIRIM on z/OS contains a vulnerability that can allow attackers to gain escalated privileges. The vulnerability occurs within the LMP SVC and allows attackers to gain supervisor state, key 0. An attacker can use a problem state program to obtain supervisor state privileges and access other system resources. Note: CAIRIM is included with several products. Please refer to the vendor advisory for a full list.

Recommendations

For: CAIRIM 1.0 z/OS
Install PTF QO78541 provided by the vendor.
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO78541

Prerequisites:
QO66290
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO66290

QO66300
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO66300

QO75220
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO75220

Affected Technologies
Computer Associates: CAIRIM 1.0 z/OS

References
Computer Associates: cairimsecurity

More information on CA Vulnerability Information Center:
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34013

Computer Associates – the Trusted Source of Security Knowledge