CVE-2020-4287

Vulnerability

A memory corruption vulnerability exists in IBM i2 Intelligent Analysis Platform version 9.2.1. The flaw resides in the document parsing component of IBM i2 Analyst's Notebook. When a user opens a specially-crafted document, the application mishandles memory, leading to corruption. This vulnerability is part of a set of similar issues disclosed in IBM Security Bulletin [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by crafting a malicious document and persuading a victim to open it using the affected software. No special network position or authentication is required; the attack relies solely on user interaction. The victim must be running a vulnerable version of the platform and open the attacker-supplied file.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the victim. This can lead to full compromise of confidentiality, integrity, and availability. Alternatively, the attacker may cause the application to crash, resulting in a denial of service.

Mitigation

IBM has released a fix for this vulnerability. Users should apply the latest update for IBM i2 Intelligent Analysis Platform 9.2.1 as provided in the security bulletin [1]. No workarounds are documented; upgrading to the patched version is the recommended mitigation.