PT-2023-9007 · Ibm · Ibm Infosphere Information Server

Paweł Żurek · Published 2023-05-19 · Updated 2023-05-26 · CVE-2023-32336

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7

Description The issue is related to the restoration of untrusted data in memory in the RMI service of the InfoSphere Information Server platform, which can lead to remote code execution. This allows a remote attacker to execute arbitrary code due to insecure deserialization in the RMI service.

Recommendations For IBM InfoSphere Information Server version 11.7, consider disabling the RMI service as a temporary workaround until a patch is available. Restrict access to the RMI service to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-02982

CVE-2023-32336

Affected Products

Ibm Infosphere Information Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32336 · Security Note
• https://ibm.com/support/pages/node/6995879 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/255285 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02982 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32336 · Vendor Advisory
• https://t.me/cvenotify/50883 · Telegram Post