description: Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900.
problem types: Gain Privileges
affected:
{
product: Aspera Shares On Demand
vendor: IBM
versions:
status: affected, version: 3.7.4
}
{
product: Aspera Application Platform On Demand
vendor: IBM
versions:
status: affected, version: 3.7.4
}
{
product: Aspera Transfer Cluster Manager
vendor: IBM
versions:
status: affected, version: 1.3.1
}
{
product: Aspera High-Speed Transfer Server
vendor: IBM
versions:
status: affected, version: 3.9.3
}
{
product: Aspera Proxy Server
vendor: IBM
versions:
status: affected, version: 1.4.3
}
{
product: Aspera Faspex On Demand
vendor: IBM
versions:
status: affected, version: 3.7.4
}
{
product: Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)
vendor: IBM
versions:
status: affected, version: 3.9.10
}
{
product: Aspera High-Speed Transfer Endpoint
vendor: IBM
versions:
status: affected, version: 3.9.3
}
{
product: Aspera Streaming
vendor: IBM
versions:
status: affected, version: 3.9.3
}
{
product: Aspera Server On Demand
vendor: IBM
versions:
status: affected, version: 3.7.4
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/AC:H/I:H/UI:N/A:H/AV:N/C:H/S:U/PR:L/RL:O/E:U/RC:C
version: 3.0
]