PT-2021-9117 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Published 2021-01-05 · Updated 2021-01-08 · CVE-2019-4728

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator Standard Edition versions 5.2.0.0 through 5.2.6.5 2 IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.0.3.2 IBM Sterling B2B Integrator Standard Edition version 6.1.0.0

Description The issue is caused by the deserialization of untrusted data, allowing a remote attacker to execute arbitrary code on the system. By sending a specially crafted request, an attacker could exploit this to execute arbitrary code with SYSTEM privileges.

Recommendations For IBM Sterling B2B Integrator Standard Edition versions 5.2.0.0 through 5.2.6.5 2, update to a version that includes a fix for the deserialization of untrusted data vulnerability. For IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.0.3.2, update to a version that includes a fix for the deserialization of untrusted data vulnerability. For IBM Sterling B2B Integrator Standard Edition version 6.1.0.0, update to a version that includes a fix for the deserialization of untrusted data vulnerability. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-4728

Affected Products

Ibm Sterling B2B Integrator Standard Edition

References · 6

• https://ibm.com/support/pages/node/6396172 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4728 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/172452 · Vendor Advisory
• https://t.me/cvenotify/8305 · Telegram Post
• https://t.me/cibsecurity/21582 · Telegram Post