PT-2020-18097 · Ibm · Ibm Spectrum Scale

Published 2020-10-20 · Updated 2021-07-21 · CVE-2020-4491

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.22 IBM Spectrum Scale versions 5.0.0.0 through 5.0.5

Description The issue allows a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon, which would cause the service to crash.

Recommendations For IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.22, update to a version outside of this range to resolve the issue. For IBM Spectrum Scale versions 5.0.0.0 through 5.0.5, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the mmfsd daemon to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-4491

Affected Products

Ibm Spectrum Scale

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-4491 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/181991 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4491 · Vendor Advisory
• https://ibm.com/support/pages/node/6349465 · Vendor Advisory