CVE-2016-0392
HighSummary
IBM General Parallel File System (GPFS) in versions 2.0.0 through 2.0.7 and 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, allows local users to gain privileges via a crafted parameter to a setuid program.
Risk Assessment
This vulnerability may lead to unauthorized privilege escalation by local users, posing a significant security risk to the system.
Recommendation
It is recommended to upgrade to the latest version of GPFS to mitigate this vulnerability and to restrict access to setuid programs.
Other vulnerabilities in IBM General Parallel File System (GPFS)
See all- CVE-2015-0198High
A vulnerability in IBM General Parallel File System (GPFS) allows remote attackers to bypass authentication and execute arbitrary programs as root in certain cipherList configurations. It affects versions 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7.
- CVE-2015-0197High
IBM General Parallel File System (GPFS) versions 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors.
Original NVD description (English source)
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.