CVE-2015-0114

Vulnerability

A stack-based buffer overflow exists in the IBM i Access for Windows Personal Communications Support component, affecting IBM i Access for Windows releases V5R4, 6.1, and 7.1 [1]. The vulnerability is caused by improper bounds checking, leading to a buffer overflow when processing input [1].

Exploitation

An attacker must have local access to the system to trigger the vulnerability. By providing specially crafted input to the affected component, the attacker can overflow a buffer and cause arbitrary code execution or application crash [1].

Impact

Successful exploitation allows a local attacker to execute arbitrary code on the system with the privileges of the current user, potentially leading to full system compromise. Alternatively, it can cause the application to crash, resulting in denial of service [1].

Mitigation

IBM has released a fix for the vulnerability in the 7.1 service release of IBM i Access for Windows (product 5770-XE1). An interim fix is available via FTP [1]. Users running unsupported versions should upgrade to a supported and fixed version [1].