Lucene search

[email protected]CVE-2020-4436

HistoryJun 10, 2020 - 1:15 p.m.

CVE-2020-4436

2020-06-1013:15:17

CWE-120

[email protected]

web.nvd.nist.gov

ibm

aspera

buffer overflow

authentication

vulnerability

ibm x-force

nvd

cve-2020-4436

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

44.8%

JSON

Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.

Affected configurations

Vulners

NVD

Node

ibmaspera_faspex_on_demandMatch3.7.4

ibmaspera_high-speed_transfer_server_for_cloud_pak_for_integrationMatch3.9.10

ibmaspera_high-speed_transfer_endpointMatch3.9.3

ibmaspera_streamingMatch3.9.3

ibmaspera_server_on_demandMatch3.7.4

ibmaspera_shares_on_demandMatch3.7.4

ibmaspera_application_platform_on_demandMatch3.7.4

ibmaspera_transfer_cluster_managerMatch1.3.1

ibmaspera_high-speed_transfer_serverMatch3.9.3

ibmaspera_proxy_serverMatch1.4.3

VendorProductVersionCPE
ibmaspera_faspex_on_demand3.7.4cpe:2.3:a:ibm:aspera_faspex_on_demand:3.7.4:*:*:*:*:*:*:*
ibmaspera_high\-speed_transfer_server_for_cloud_pak_for_integration3.9.10cpe:2.3:a:ibm:aspera_high\-speed_transfer_server_for_cloud_pak_for_integration:3.9.10:*:*:*:*:*:*:*
ibmaspera_high\-speed_transfer_endpoint3.9.3cpe:2.3:a:ibm:aspera_high\-speed_transfer_endpoint:3.9.3:*:*:*:*:*:*:*
ibmaspera_streaming3.9.3cpe:2.3:a:ibm:aspera_streaming:3.9.3:*:*:*:*:*:*:*
ibmaspera_server_on_demand3.7.4cpe:2.3:a:ibm:aspera_server_on_demand:3.7.4:*:*:*:*:*:*:*
ibmaspera_shares_on_demand3.7.4cpe:2.3:a:ibm:aspera_shares_on_demand:3.7.4:*:*:*:*:*:*:*
ibmaspera_application_platform_on_demand3.7.4cpe:2.3:a:ibm:aspera_application_platform_on_demand:3.7.4:*:*:*:*:*:*:*
ibmaspera_transfer_cluster_manager1.3.1cpe:2.3:a:ibm:aspera_transfer_cluster_manager:1.3.1:*:*:*:*:*:*:*
ibmaspera_high\-speed_transfer_server3.9.3cpe:2.3:a:ibm:aspera_high\-speed_transfer_server:3.9.3:*:*:*:*:*:*:*
ibmaspera_proxy_server1.4.3cpe:2.3:a:ibm:aspera_proxy_server:1.4.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	aspera_faspex_on_demand	3.7.4	cpe:2.3:a:ibm:aspera_faspex_on_demand:3.7.4:::::::*
ibm	aspera_high\-speed_transfer_server_for_cloud_pak_for_integration	3.9.10	cpe:2.3:a:ibm:aspera_high\-speed_transfer_server_for_cloud_pak_for_integration:3.9.10:::::::*
ibm	aspera_high\-speed_transfer_endpoint	3.9.3	cpe:2.3:a:ibm:aspera_high\-speed_transfer_endpoint:3.9.3:::::::*
ibm	aspera_streaming	3.9.3	cpe:2.3:a:ibm:aspera_streaming:3.9.3:::::::*
ibm	aspera_server_on_demand	3.7.4	cpe:2.3:a:ibm:aspera_server_on_demand:3.7.4:::::::*
ibm	aspera_shares_on_demand	3.7.4	cpe:2.3:a:ibm:aspera_shares_on_demand:3.7.4:::::::*
ibm	aspera_application_platform_on_demand	3.7.4	cpe:2.3:a:ibm:aspera_application_platform_on_demand:3.7.4:::::::*
ibm	aspera_transfer_cluster_manager	1.3.1	cpe:2.3:a:ibm:aspera_transfer_cluster_manager:1.3.1:::::::*
ibm	aspera_high\-speed_transfer_server	3.9.3	cpe:2.3:a:ibm:aspera_high\-speed_transfer_server:3.9.3:::::::*
ibm	aspera_proxy_server	1.4.3	cpe:2.3:a:ibm:aspera_proxy_server:1.4.3:::::::*

CNA Affected

[
  {
    "product": "Aspera Faspex On Demand",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.7.4"
      }
    ]
  },
  {
    "product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.9.10"
      }
    ]
  },
  {
    "product": "Aspera High-Speed Transfer Endpoint",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.9.3"
      }
    ]
  },
  {
    "product": "Aspera Streaming",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.9.3"
      }
    ]
  },
  {
    "product": "Aspera Server On Demand",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.7.4"
      }
    ]
  },
  {
    "product": "Aspera Shares On Demand",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.7.4"
      }
    ]
  },
  {
    "product": "Aspera Application Platform On Demand",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.7.4"
      }
    ]
  },
  {
    "product": "Aspera Transfer Cluster Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.1"
      }
    ]
  },
  {
    "product": "Aspera High-Speed Transfer Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.9.3"
      }
    ]
  },
  {
    "product": "Aspera Proxy Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.3"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/180902

www.ibm.com/support/pages/node/6221324

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for CVE-2020-4436

cvelist1 nvd1 prion1 ibm1