Download

Abstract

This Fix Pack will upgrade your SPSS Statistics 26.0.0.0

Download Description

This Fix Pack provides important product corrections for SPSS Statistics 26.0.0.0.

Issues Corrected and Release Note(s):  Fix List

Prerequisites

This Fix Pack is language independent but can only be installed over existing client and server installations of IBM SPSS Statistics 26.0.0.0

Installation Instructions

Installation - Windows

1. Log in as a local administrator.
2. Download the Fix Pack to a temporary location on your hard drive.
3. Ensure that no versions of Statistics are running.
4. Run the Statistics 26.0.0.1 Fix Pack executable.
   Note: you must use "Run as Administrator" by first right-clicking on the executable.
5. Statistics 26.0.0.1 is ready to run. Use the Help -> About menu to verify that 26.0.0.1 is now the installed version.

Guidelines for unattended/pushed installations for Windows-based clients:

NOTE: This Fix Pack may require the machine to be rebooted to complete the installation. Please be aware that "pushing" the installation in unattended, silent mode may therefore force an unexpected machine reboot on a user, and schedule such installations accordingly.

The SPSS Statistics 26.0.0.1 for Windows Fix Pack obeys the same rules documented in the Authorized User License Administrator's Guide and Concurrent License Administrator's Guide regarding "Extracting the Contents of a Downloaded Installer file" and "Pushing an Installation to Windows Computers".

In this case:

1. Download the appropriate installer file to a temporary location on your hard drive.
2. Open a command window as the local Administrator account and change directory to the temporary download location.
3. Extract the "SPSSStatistics26.0.0.1Patch.msi" and locale-specific .mst file into a specified location from the downloaded FixPack installer file, "26.0-IM-S26STATC-<OS>-FP001.exe",using the documented "/b" switch: 26.0-IM-S26STATC-<OS>-FP001.exe /b"c:\Stats26001FixPack" (where <OS> is your operating system)
4. You can then copy the two extracted files to a network share for easier distribution.
5. Install the patch:
   
   msiexec /i "c:\Stats26001FixPack\SPSS_Statistics_26001_<OS>_Patch.msi" /qn /L*V "%temp%\SPSSStatistics26001PatchLog.txt" INSTALLPYTHON="1" TRANSFORMS="c:\Stats26001FixPack\1033.mst"
   
   (where <OS> is the same operating system specification as in step 3)

Installation - Mac

1. Download and save the Statistics 26.0.0.1 Fix Pack to your local hard drive.
2. Ensure that no versions of Statistics are running.
3. Execute the Statistics 26.0.0.1 Fix Pack installer from the downloaded .dmg file.
4. Statistics 26.0.0.1 is ready to run. Use the About Statistics 26 menu to verify that 26.0.0.1 is the installed version.

IBM SPSS Statistics 26 release is supported on Apple Macintosh OS X 10.10.x (Yosemite) through macOS 10.15.x

Guidelines for unattended/pushed installations for Macintosh-based clients:

IBM SPSS Statistics 26 FixPack 1 for Mac OS X has a silent (push) installer. To install this FixPack on Mac systems, do the following:

1. Open the 26.0-IM-S26STATC-Mac-Silent-FP001.dmg disk image and copy the two files to your desktop (or any writable location).
2. Open a Terminal window and change directories to the location of the patch installer and installer.properties file.
3. Edit the installer.properties file to suit your needs. The USER_INSTALL_DIR parameter must be defined. For example, if the current SPSS Statistics 26 install is in the default /Applications/IBM/SPSS/Statistics/26, USER_INSTALL_DIR would be:
   USER_INSTALL_DIR=/Applications/IBM/SPSS/Statistics/26
4. Uncomment and modify other parameters as needed.
5. Need to execute the installer as the 'root' user, use the following command:
   
   ./SPSS_Statistics_Installer_Silent.bin -f installer.properties

Installation - Linux

1. Download the Fix Pack to a temporary location on your hard drive.
2. Ensure that no versions of Statistics are running.
3. Open a terminal window and execute the 26.0-IM-S26STATC-Linux8664-FP001.bin executable file as the ‘root’ user.
4. Statistics 26.0.0.1 is ready to run. Use the Help -> About menu to verify that 26.0.0.1 is the installed version.

Guidelines for unattended/pushed installations for Linux-based clients:

The SPSS Statistics 26.0.0.1 for Linux Fix Pack obeys the same rules documented in the Authorized User License Administrator's Guide and Concurrent License Administrator's Guide regarding "Running a Silent Installation on Mac and Linux Computers".

Note: Please contact IBM SPSS Technical Support to obtain the appropriate installer.properties file for the Linux platform.

SPSS Statistics Server - 26.0 FP1 Installation Instructions

Installation - Windows

1. Log in as a local administrator.
2. Download the Fix Pack contents to a temporary location.
3. Ensure that the same version of Statistics Server is not running, as multiple versions can be installed on the server.
4. Run the Statistics Server 26.0.0.1 Fix Pack executable.
   Note: you must use "Run as Administrator" by first right-clicking on the executable.
5. SPSS Statistics Server 26.0.0.1 is ready to run. Check the service name or add/remove programs, or launch statistics and run the SHOW VERSION command to verify 26.0.0.1 as the installed version.

Installation - UNIX/Linux

Note: On UNIX and Linux, the Statistics Server upgrade is now a true incremental upgrade and not a complete, fresh installation. Installing the Fix Pack for the appropriate platform should be similar to the instructions for installing your server given in the SPSS Statistics Server Installation Instructions. We recommend that you make a backup copy of spssdxcfg.ini prior to installation on the UNIX / Linux server; the installation may remove the R section of that file and necessitate a manual update to it after FP1 installation.

1. Download the Fix Pack to a directory on the server machine.
2. Shut down Statistics Server prior to applying the Fix Pack.
3. You need to ensure the ownership and permissions for the /bin, /lib and /common subdirectories of the Statistics installation directory. For example, if you installed as root, to change the ownership and permissions, go to Statistics installation directory and run the following commands at the UNIX prompt:
   
   chown -R root:root bin lib commonchmod -R 777 bin lib common
4. When running SPSS Statistics Server with internal authentication, a regular user can be the owner of these directories. Refer to the SPSS Statistics Server Administrator’s Guide for more information.
5. The Fix Pack can be installed silently using the installer.properties file that comes with the 26.0 release (on the DVD): ./<installer_name> -f installer.properties where <installer_name> is the installer .bin file that you ftp'ed to the server.
6. You can also execute the installer directly to launch a graphical version of the installer. (Note: You will need an X Window System to do so): ./<installer_name>
   Note for graphical installer: You should change the default installer directory for the patch in the Install Wizard to point it to the directory on the server where Statistics Server 26.0 is installed.
7. Start the Statistics Server after the Fix Pack installation is complete.
8. Run ./statisticsb and enter SHOW VERSION. The response should indicate 26.00.00.01

Apache Log4j CVE-2021-44228 vulnerability in IBM SPSS Modeler, IBM SPSS Analytic Server, and IBM SPSS Collaboration and Deployment Services

Troubleshooting

 Problem

The popular log4j library security issues recently documented affect certain IBM SPSS Modeler, IBM SPSS Analytic Server, and IBM SPSS Collaboration and Deployment Services deployments.  

CVE-2021-44228 is known to affect log4j 2.0-2.14 that is used by the following products:

IBM SPSS Collaboration and Deployment Services 8.3 (Server, Remote Process Server, Remote Scoring Server, and Deployment Manager)

IBM SPSS Analytic Server 3.2.2 and 3.3

IBM SPSS Modeler 18.3, 18.2.2 (Client, Server, Batch, and Solution Publisher)

IBM SPSS Modeler Premium 18.3, 18.2.2

Patches for this issue are available for all affected components.

CVE-2021-4104 is reported to affect log4j 1.x (some sources state it affects strictly 1.2 while others are reporting 1.x).

Older versions of IBM SPSS Modeler (including Premium components), IBM SPSS Analytic Server, and IBM SPSS Collaboration and Deployment Services leverage various versions of log4j 1.x.  Patches are being produced to update these products to use log4j 2.16+ resolving this issue.  

Resolving The Problem

CVE-2021-44228 is resolved by available patches.

CVE-2021-4104 are still being developed.  

Current patches are listed here.  Ensure all prerequisite patches are installed first.

IBM SPSS Modeler 18.3.0.0

1. interim fix: 18.3.0.0-IM-S18MODELER-Win64-IF006-LOG4J2 (10.38 MB)
18.3.0.0-IM-S18MODELER-Win64-IF006-LOG4J2
Dec 14, 2021

2. interim fix: 18.3.0.0-IM-S18MODELER-MacOS64-IF006-LOG4J2 (10.17 MB)
18.3.0.0-IM-S18MODELER-MacOS64-IF006-LOG4J2
Dec 14, 2021

3. interim fix: 18.3.0.0-IM-S18MODELER-IF006-zLinux64-LOG4J2 (10.3 MB)
18.3.0.0-IM-S18MODELER-IF006-zLinux64-LOG4J2
Dec 14, 2021

4. interim fix: 18.3.0.0-IM-S18MODELER-Premium-IF006-LOG4J2 (1.94 MB)
18.3.0.0-IM-S18MODELER-Premium-IF006-LOG4J2
Dec 14, 2021

5. interim fix: 18.3.0.0-IM-S18MODELER-IF006-pLinux64-LOG4J2 (10.3 MB)
18.3.0.0-IM-S18MODELER-IF006-pLinux64-LOG4J2
Dec 14, 2021

IBM SPSS Modeler 18.2.2.0

1. interim fix: 18.2.2.0-IM-S18MODELER-IF030-Log4j2 (1.93 MB)
18.2.2.0-IM-S18MODELER-IF030-Log4j2
Dec 14, 2021

2. interim fix: 18.2.2.0-IM-S18MODELER-Premium-IF030-LOG4J2 (1.93 MB)
18.2.2.0-IM-S18MODELER-Premium-IF030-LOG4J2

Apache Log4j CVE-2021-44228 vulnerability in IBM SPSS Statistics News Abstract IBM is actively responding to the reported remote code execution vulnerability in the Apache Log4j 2 Java library dubbed Log4Shell (or LogJam)

News

Abstract

IBM is actively responding to the reported remote code execution vulnerability in the Apache Log4j 2 Java library dubbed Log4Shell (or LogJam).

The IBM SPSS Statistics Development team has produced Interim Fixes for our currently supported versions, updating the Log4j .jar files to version 2.16.0. This version resolves both CVE-2021-44228 and CVE-2021-45046 vulnerabilities.

NOTE: These fixes have been updated to include Log4j version 2.16.0 to resolve both CVE-2021-44228 and CVE-2021-45046.
If you have downloaded fixes from this note prior to 17 December 2021, please download and apply these new, updated fixes.

Content

For more details about this specific vulnerability

• See: https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/

For information about IBM SPSS Modeler

• See https://www.ibm.com/support/pages/node/6526076

• IBM SPSS Amos, IBM SPSS Data Access Pack and the IBM SPSS Concurrent License Manager and Tools products are not affected by this issue.
• An Interim Fix now exists for each of the currently supported releases of IBM SPSS Statistics. Supported versions are release 25.0 and later.  If you have deployed IBM SPSS Statistics 24.0 or earlier, these versions are End of Service and are no longer supported.  Please upgrade to a supported release.
• Update your version of IBM SPSS Statistics to the latest Fixpack (or Modified Release).

For example, if you have SPSS Statistics 27.0 deployed, update it to Statistics 27.0.1 before applying the associated interim fix.

If you do not know your current release and Fixpack level, see:

https://www-01.ibm.com/support/docview.wss?uid=swg21989276

Fixpacks and Modified Releases:

IBM SPSS Statistics 28.0 Modified Release 1

IBM SPSS Statistics 27.0 Modified Release 1

IBM SPSS Statistics 26.0 Fixpack 1

IBM SPSS Statistics 25.0 Fixpack 2

Interim Fixes

IBM SPSS Statistics 28.0.1.0, IF 009:  IF 28.0.1.0-9
IBM SPSS Statistics 27.0.1.0, IF 023:  IF 27.0.1.0-23
IBM SPSS Statistics 26.0.0.1 (Windows) or 26.0.0.2 (macOS), IF 017:  IF 26.0.1-017
IBM SPSS Statistics 25.0.0.2, IF 017: IF 25.0.0.2-17