CVE-2021-20491

IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792.

CVSS v3 4.4 MEDIUM
CVSS v2.0 2.1 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/197792	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6442993	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/197792	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6442993	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:spectrum_protect::::::::
	cpe:2.3:a:ibm:spectrum_protect::::::::
	cpe:2.3:a:ibm:spectrum_protect:8.1.11.000:::::::*

History

21 Nov 2024, 05:46

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/197792 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/197792 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/6442993 - Patch, Vendor Advisory~~	() https://www.ibm.com/support/pages/node/6442993 - Patch, Vendor Advisory

Information

Published : 2021-04-16 16:15

Updated : 2024-11-21 05:46

NVD link : CVE-2021-20491

Mitre link : CVE-2021-20491

CVE.ORG link : CVE-2021-20491

JSON object : View

Products Affected

ibm

spectrum_protect

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2021-20491", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2021-04-16T16:15:12.947", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/197792", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6442993", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/197792", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/6442993", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792."}, {"lang": "es", "value": "IBM Spectrum Protect Server versiones 7.1 y 8.1, est\u00e1 sujeto a un desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria causado por una comprobaci\u00f3n de l\u00edmites inapropiada durante el an\u00e1lisis de los comandos. Al emitir un comando de este tipo con un par\u00e1metro inapropiado, un administrador autorizado podr\u00eda desbordar un b\u00fafer y causar que el servidor se bloquee. IBM X-Force ID: 197792"}], "lastModified": "2024-11-21T05:46:39.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81C8CA99-86D7-4F45-BF4D-2657FF8AA7AE", "versionEndExcluding": "7.1.13", "versionStartIncluding": "7.1.0.000"}, {"criteria": "cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C2A3F7C-BCC1-4A3B-9741-59885B6F2BDD", "versionEndIncluding": "8.1.10.100", "versionStartIncluding": "8.1.0.000"}, {"criteria": "cpe:2.3:a:ibm:spectrum_protect:8.1.11.000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64431F7E-0964-4400-B73A-F75A8E849C39"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}