Security Bulletin:Open Source Apache Zookeeper Vulnerabilities in IBM eDiscovery Analyzer

Summary

Apache ZooKeeper is vulnerable to a buffer overflow, caused by improper bounds checking by the C client shells “cli_st” and “cli_mt”. By sending an overly long command, a attacker could overflow a buffer and execute arbitrary code on the system.

Vulnerability Details

CVEID: CVE-2016-5017 DESCRIPTION: Apache ZooKeeper is vulnerable to a buffer overflow, caused by improper bounds checking by the C client shells “cli_st” and “cli_mt”. By sending an overly long command, a attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116995 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM eDiscovery Analyzer 2.2.2

Workarounds and Mitigations

This is not applicable to IBM eDiscovery Analyzer