CVE-2021-39050

Vulnerability

IBM i2 Analyst's Notebook versions 9.2.0, 9.2.1, and 9.2.2 are affected by a stack-based buffer overflow vulnerability caused by improper bounds checking. The issue resides in the application's handling of certain data, requiring user interaction to trigger the vulnerable code path. [1]

Exploitation

A local attacker with no prior authentication can exploit this vulnerability by convincing a user to perform a specific action (e.g., opening a crafted file or interacting with a malicious element). The attack complexity is low, and the attacker can overflow a stack buffer to corrupt memory. [1]

Impact

Successful exploitation allows the attacker to gain lower-level privileges, resulting in low impact on confidentiality, integrity, and availability. The attacker does not achieve full system compromise but can affect the application's behavior or access limited resources. [1]

Mitigation

IBM has released a fix: upgrade to i2 Analyst's Notebook 9.3.1 continuous delivery update. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. [1]