CVE-2020-4435

Vulnerability

Certain IBM Aspera applications are vulnerable to arbitrary memory corruption via the HTTP fallback service, as described in the IBM security bulletin [1]. The vulnerability affects the product's configuration; the exact versions are not individually listed in the available references, but the bulletin indicates fixes are included in the product versions detailed on the support page [1]. The CVSS base score is 7.5, with a vector of (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) per the CVE description, indicating the attacker must have low privileges and the attack is complex [1].

Exploitation

An attacker requires intimate knowledge of the system and must be able to interact with the HTTP fallback service [1]. According to the CVE description, exploitation depends on product configuration. The attacker must have low privileges (PR:L), and the attack complexity is high (AC:H), meaning successful exploitation requires specific conditions or repeated attempts. No user interaction is required (UI:N) [1].

Impact

On successful exploitation, the attacker can achieve arbitrary memory corruption, leading to arbitrary code execution or a denial-of-service (DoS) condition. The scope is unchanged (S:U), and the confidentiality, integrity, and availability impacts are all rated high (C:H/I:H/A:H) [1].

Mitigation

The vulnerability is fixed in the product versions listed in the IBM security bulletin [1]; the bulletin provides a table of affected components and their corresponding fixed versions. Users should apply the updates as specified. No workarounds are mentioned in the available references.