CVE-2020-4550

Vulnerability

IBM i2 Analyst Notebook versions 9.2.1 and 9.2.2 contain a memory corruption vulnerability [1]. The flaw exists in the parsing of specially-crafted files, which can be triggered when a victim opens a malicious file. No special configuration is required; the vulnerable code path is reachable through normal file opening operations.

Exploitation

An attacker must convince a user to open a specially-crafted file using the affected software. The attacker does not need prior authentication or network access; the attack is local and requires user interaction. Upon opening the file, the memory corruption is triggered, leading to arbitrary code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the user running IBM i2 Analyst Notebook. This can result in full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

IBM has released a security bulletin [1] addressing this vulnerability. Users should upgrade to the latest fixed version as specified in the bulletin. No workarounds are documented; applying the patch is the recommended mitigation.