Security Bulletin: IBM Storage Protect Backup-Archive Client and IBM Storage Protect for Virtual Environments are vulnerable to arbitrary code execution due to a DLL hijacking flaw (CVE-2023-35897)

Summary

IBM Storage Protect Backup-Archive Client and IBM Storage Protect for Virtual Environments (Data Protection for VMware and Data Protection for Hyper-V) can be affected by a DLL hijacking flaw (CVE-2023-35897). The flaw can lead to arbitrary code execution, as described in the “Vulnerability Details” section. This issue affects the specified products running on Microsoft Windows. Other platforms are not affected.

Vulnerability Details

CVEID:CVE-2023-35897
**DESCRIPTION:**IBM Spectrum Protect Client could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/259246 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading.

Workarounds and Mitigations

None