CVE-2020-4467

Vulnerability

A memory corruption vulnerability exists in IBM i2 Intelligent Analysis Platform version 9.2.1. The flaw occurs when the application processes a specially crafted document, leading to memory corruption. An attacker can trigger this by persuading a victim to open a malicious document. The affected version is 9.2.1.

Exploitation

An attacker must convince a victim to open a specially crafted document, typically via email or other social engineering. The attacker does not require any authentication or special network access beyond delivering the document to the victim. Once the victim opens the document, the memory corruption is triggered, allowing the attacker to execute arbitrary code.

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the victim. This can lead to complete compromise of confidentiality, integrity, and availability, as the attacker can install programs, view, change, or delete data, or create new accounts with full user rights. The application may also crash.

Mitigation

IBM has released a security bulletin [1] that provides remediation steps. Users should update to the patched version as specified by IBM. No workarounds were disclosed in the available reference.