PT-2020-5538 · Ibm · Ibm I2 Analyst'S Notebook+1

Kexu Wang · Published 2020-02-04 · Updated 2021-07-21 · CVE-2020-4287

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM i2 Intelligent Analyis Platform version 9.2.1 IBM i2 Analyst's Notebook (affected versions not specified)

Description The issue is caused by a memory corruption error, which could allow a remote attacker to execute arbitrary code on the system. This can be achieved by persuading a victim to open a specially-crafted document, potentially allowing the attacker to execute arbitrary code with the privileges of the victim or cause the application to crash.

Recommendations For IBM i2 Intelligent Analyis Platform version 9.2.1, update to a version that fixes the memory corruption error to prevent arbitrary code execution. For IBM i2 Analyst's Notebook, avoid using specially-crafted ANB files until a patch is available, and consider restricting access to sensitive documents to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability in IBM i2 Analyst's Notebook.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2021-01137

CVE-2020-4287

Affected Products

Ibm I2 Analyst'S Notebook

Ibm I2 Intelligent Analyis Platform

References · 7

• https://ibm.com/support/pages/node/6209081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4287 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01137 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/176269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4287 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-026 · Note
• https://t.me/cvenotify/3796 · Telegram Post