CVE-2020-4721

Vulnerability

IBM i2 Analyst Notebook versions 9.2.0 and 9.2.1 are affected by a memory corruption vulnerability [1]. The flaw exists in the handling of specially-crafted files. When a user opens such a file, the application may corrupt memory, leading to arbitrary code execution. No special configuration is required; the vulnerability is reachable through normal file opening operations.

Exploitation

Exploitation requires a local attacker to persuade a victim to open a malicious file. The attacker does not need authentication or elevated privileges. The victim must be using an affected version of IBM i2 Analyst Notebook. The attacker can craft a file that triggers the memory corruption upon parsing. User interaction is necessary.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the user running the application. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

IBM has released a fix for this vulnerability. Users should upgrade to the latest version of IBM i2 Analyst Notebook as specified in the security bulletin [1]. No workaround is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.