Description
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.
References
- 59687 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21680841
- http://www-01.ibm.com/support/docview.wss?uid=swg21679952
- 69034 vdb-entry
- ibm-tip-ewas-cve20143020-install(93056) vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21680254
- 60552 third-party-advisory
- 59795 third-party-advisory